914630ee2abeefd37b3892f90ffbb25199b5c8a5e2133ea2c09d2a7a8cb07ca7

Analysis

Target
78cace791ed1fbb36dd6720d2c4b27c2.dll
Size 479KB
Sample220117-2v5epseacj
SHA256 914630ee2abeefd37b3892f90ffbb25199b5c8a5e2133ea2c09d2a7a8cb07ca7
MD5 78cace791ed1fbb36dd6720d2c4b27c2
SHA1 af078fca23df9514cec0a6ca824750b5da75a21d
SHA512 623aa6083fbc1e8242135e32bfda13a3591e650517a0bcf652755dc75704f40d70bd1c5e85c520379df55040f999ee1b2a17e658356329fec93618bf24cccbfc
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1872	1656	regsvr32.exe	27
PID 1656 wrote to memory of 1872	1656	regsvr32.exe	27
PID 1656 wrote to memory of 1872	1656	regsvr32.exe	27
PID 1656 wrote to memory of 1872	1656	regsvr32.exe	27
PID 1656 wrote to memory of 1872	1656	regsvr32.exe	27
PID 1656 wrote to memory of 1872	1656	regsvr32.exe	27
PID 1656 wrote to memory of 1872	1656	regsvr32.exe	27
PID 1872 wrote to memory of 652	1872	regsvr32.exe	28
PID 1872 wrote to memory of 652	1872	regsvr32.exe	28
PID 1872 wrote to memory of 652	1872	regsvr32.exe	28
PID 1872 wrote to memory of 652	1872	regsvr32.exe	28
PID 1872 wrote to memory of 652	1872	regsvr32.exe	28
PID 1872 wrote to memory of 652	1872	regsvr32.exe	28
PID 1872 wrote to memory of 652	1872	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\78cace791ed1fbb36dd6720d2c4b27c2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\78cace791ed1fbb36dd6720d2c4b27c2.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\78cace791ed1fbb36dd6720d2c4b27c2.dll",DllRegisterServer
    3⤵
    PID:652

memory/1656-54-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Download

memory/1872-56-0x0000000074EC1000-0x0000000074EC3000-memory.dmp

Download

memory/1872-58-0x0000000000235000-0x0000000000236000-memory.dmp

Download

memory/1872-57-0x0000000000211000-0x0000000000235000-memory.dmp

Download