a569b9a917af48f77d2af8e7b3d7aa060b4e9da5c5d5f0aee9cb60036e80d161

Analysis

Target
fa32794dcda725d2785ff7b08abb84b6.dll
Size 479KB
Sample220117-2bed6sdgaj
SHA256 a569b9a917af48f77d2af8e7b3d7aa060b4e9da5c5d5f0aee9cb60036e80d161
MD5 fa32794dcda725d2785ff7b08abb84b6
SHA1 f280e78381ebfab4b42171c5d8a597a234c942d8
SHA512 1aa0d10a457807ec70414d5b8282faa5278fb1c95c4f10d898621eb984b2e4f4fabbb829273bfcc260a6b3f9eea0bdaa85bec47da47f3e75c61a67f86ff6cce1
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1740	1212	regsvr32.exe	27
PID 1212 wrote to memory of 1740	1212	regsvr32.exe	27
PID 1212 wrote to memory of 1740	1212	regsvr32.exe	27
PID 1212 wrote to memory of 1740	1212	regsvr32.exe	27
PID 1212 wrote to memory of 1740	1212	regsvr32.exe	27
PID 1212 wrote to memory of 1740	1212	regsvr32.exe	27
PID 1212 wrote to memory of 1740	1212	regsvr32.exe	27
PID 1740 wrote to memory of 652	1740	regsvr32.exe	28
PID 1740 wrote to memory of 652	1740	regsvr32.exe	28
PID 1740 wrote to memory of 652	1740	regsvr32.exe	28
PID 1740 wrote to memory of 652	1740	regsvr32.exe	28
PID 1740 wrote to memory of 652	1740	regsvr32.exe	28
PID 1740 wrote to memory of 652	1740	regsvr32.exe	28
PID 1740 wrote to memory of 652	1740	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fa32794dcda725d2785ff7b08abb84b6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fa32794dcda725d2785ff7b08abb84b6.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\fa32794dcda725d2785ff7b08abb84b6.dll",DllRegisterServer
    3⤵
    PID:652

memory/1212-54-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Download

memory/1740-56-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1740-58-0x0000000000215000-0x0000000000216000-memory.dmp

Download

memory/1740-57-0x00000000001F1000-0x0000000000215000-memory.dmp

Download