cebc9dccf2e733f226d16d91bb03a2e378e9b740e098eaaaf25f794556beac11

Analysis

Target
obe4WFpXYSWLviR.dll
Size 472KB
Sample220117-lfchdahcb4
SHA256 cebc9dccf2e733f226d16d91bb03a2e378e9b740e098eaaaf25f794556beac11
MD5 d61fd19b922c21819bc4d2b1098cf5c3
SHA1 b64f6e13fadf3a8a75f298f86afdc3670bdb0d98
SHA512 f6e76d122715c9f6c1f7c18c330dda7bf2744599df69a98395a4de6d2714b3f02e4bc91653ec4ebbf171f2c1517b54b453a7534ddcde70c7902d1bf412aa78e8
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 948 wrote to memory of 1564	948	regsvr32.exe	27
PID 1564 wrote to memory of 1724	1564	regsvr32.exe	28
PID 1564 wrote to memory of 1724	1564	regsvr32.exe	28
PID 1564 wrote to memory of 1724	1564	regsvr32.exe	28
PID 1564 wrote to memory of 1724	1564	regsvr32.exe	28
PID 1564 wrote to memory of 1724	1564	regsvr32.exe	28
PID 1564 wrote to memory of 1724	1564	regsvr32.exe	28
PID 1564 wrote to memory of 1724	1564	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\obe4WFpXYSWLviR.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\obe4WFpXYSWLviR.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\obe4WFpXYSWLviR.dll",DllRegisterServer
    3⤵
    PID:1724

memory/948-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Download

memory/1564-56-0x0000000075B51000-0x0000000075B53000-memory.dmp

Download

memory/1564-57-0x00000000002B1000-0x00000000002D5000-memory.dmp

Download

memory/1564-58-0x00000000002D5000-0x00000000002D6000-memory.dmp

Download