960f02b5f7d39c4ebff61c8345c69f2f84e42d27db7442cb8a37c5df91dff07d

Analysis

Target
f584ae0cf0fdffd42d26ad859bc2103f.dll
Size 472KB
Sample220117-mgj5aaheb9
SHA256 960f02b5f7d39c4ebff61c8345c69f2f84e42d27db7442cb8a37c5df91dff07d
MD5 f584ae0cf0fdffd42d26ad859bc2103f
SHA1 fa003fb8ddb36ac51c857aa02a2beeabd61b8576
SHA512 96a80215da1f18c04644a0cfac1569e8267306ac38eb292cc0736f95ef51659dd586329ea7ea330a1dfc8730750522f0285beedb86bcb2118ed12618d3a13caa
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1100	1688	regsvr32.exe	27
PID 1100 wrote to memory of 668	1100	regsvr32.exe	28
PID 1100 wrote to memory of 668	1100	regsvr32.exe	28
PID 1100 wrote to memory of 668	1100	regsvr32.exe	28
PID 1100 wrote to memory of 668	1100	regsvr32.exe	28
PID 1100 wrote to memory of 668	1100	regsvr32.exe	28
PID 1100 wrote to memory of 668	1100	regsvr32.exe	28
PID 1100 wrote to memory of 668	1100	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f584ae0cf0fdffd42d26ad859bc2103f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f584ae0cf0fdffd42d26ad859bc2103f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f584ae0cf0fdffd42d26ad859bc2103f.dll",DllRegisterServer
    3⤵
    PID:668

memory/1100-56-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1100-58-0x0000000000235000-0x0000000000236000-memory.dmp

Download

memory/1100-57-0x0000000000211000-0x0000000000235000-memory.dmp

Download

memory/1688-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download