3722d5ae851071da6f65b02ad87d0e46c4d6ba2970570bb78c9eaf9832ddde99

Analysis

Target
0ad53d81e19070076de3b39edfb6e5c9.dll
Size 736KB
Sample220117-vbn52sbfgl
SHA256 3722d5ae851071da6f65b02ad87d0e46c4d6ba2970570bb78c9eaf9832ddde99
MD5 0ad53d81e19070076de3b39edfb6e5c9
SHA1 8c50fcd0f7529131e5d9a53b38dac058157e1fb3
SHA512 169e986ea6141ec11974a505c321e3a2c1b35128ce947b6a38cc4091d54c8ef1758fa6ba6bd25dd2a1683a3587c7a1ddb6dfd1256a55f4658c7ebabe909f261f
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1532	1724	regsvr32.exe	27
PID 1724 wrote to memory of 1532	1724	regsvr32.exe	27
PID 1724 wrote to memory of 1532	1724	regsvr32.exe	27
PID 1724 wrote to memory of 1532	1724	regsvr32.exe	27
PID 1724 wrote to memory of 1532	1724	regsvr32.exe	27
PID 1724 wrote to memory of 1532	1724	regsvr32.exe	27
PID 1724 wrote to memory of 1532	1724	regsvr32.exe	27
PID 1532 wrote to memory of 1176	1532	regsvr32.exe	28
PID 1532 wrote to memory of 1176	1532	regsvr32.exe	28
PID 1532 wrote to memory of 1176	1532	regsvr32.exe	28
PID 1532 wrote to memory of 1176	1532	regsvr32.exe	28
PID 1532 wrote to memory of 1176	1532	regsvr32.exe	28
PID 1532 wrote to memory of 1176	1532	regsvr32.exe	28
PID 1532 wrote to memory of 1176	1532	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0ad53d81e19070076de3b39edfb6e5c9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0ad53d81e19070076de3b39edfb6e5c9.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\0ad53d81e19070076de3b39edfb6e5c9.dll",DllRegisterServer
    3⤵
    PID:1176

memory/1532-56-0x0000000075B11000-0x0000000075B13000-memory.dmp

Download

memory/1532-58-0x00000000001D5000-0x00000000001D6000-memory.dmp

Download

memory/1532-57-0x00000000001B1000-0x00000000001D5000-memory.dmp

Download

memory/1724-54-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Download