bf322e978cd18eaecccc04e07230d1ca5cf62b105363720281c1663ae585521f

Analysis

Target
731d74f65a0505876e8fa86b478d1a64.dll
Size 479KB
Sample220117-2bd4eadca3
SHA256 bf322e978cd18eaecccc04e07230d1ca5cf62b105363720281c1663ae585521f
MD5 731d74f65a0505876e8fa86b478d1a64
SHA1 7020842336a702d6106c399cdc15ca5f4c9f008c
SHA512 6a7586e7d8da57c0017f01d7b31edcf6f72d6c91b852bfddb2d9bd5ec772440e0c7fcd81669b6a6e7c17a7ae4a6792bf05a08c1ac6425e0e36f23b4cdca688fe
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 880	1452	regsvr32.exe	27
PID 1452 wrote to memory of 880	1452	regsvr32.exe	27
PID 1452 wrote to memory of 880	1452	regsvr32.exe	27
PID 1452 wrote to memory of 880	1452	regsvr32.exe	27
PID 1452 wrote to memory of 880	1452	regsvr32.exe	27
PID 1452 wrote to memory of 880	1452	regsvr32.exe	27
PID 1452 wrote to memory of 880	1452	regsvr32.exe	27
PID 880 wrote to memory of 1112	880	regsvr32.exe	28
PID 880 wrote to memory of 1112	880	regsvr32.exe	28
PID 880 wrote to memory of 1112	880	regsvr32.exe	28
PID 880 wrote to memory of 1112	880	regsvr32.exe	28
PID 880 wrote to memory of 1112	880	regsvr32.exe	28
PID 880 wrote to memory of 1112	880	regsvr32.exe	28
PID 880 wrote to memory of 1112	880	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\731d74f65a0505876e8fa86b478d1a64.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\731d74f65a0505876e8fa86b478d1a64.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\731d74f65a0505876e8fa86b478d1a64.dll",DllRegisterServer
    3⤵
    PID:1112

memory/880-56-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/880-58-0x00000000001D5000-0x00000000001D6000-memory.dmp

Download

memory/880-57-0x00000000001B1000-0x00000000001D5000-memory.dmp

Download

memory/1452-54-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

Download