5986776cce84b07f4766a6c8183d36a9b30e78434d6a2afaacf40bc1f30df3d6

Analysis

Target
kd9vBRH.dll
Size 479KB
Sample220118-mkdfxaaga2
SHA256 5986776cce84b07f4766a6c8183d36a9b30e78434d6a2afaacf40bc1f30df3d6
MD5 e764f3a18f5b54e3dee0fcdd8daea6de
SHA1 3f543faf3e38308dab544817719f074b522d497c
SHA512 392ab42cdb60181c45a5a95a9d985b307a023952a4352576b8a94802682aeab657c9dd8a7c7361abb1e492c702020a2c5029869846bf976d31be790a3dc22b27
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 840	1580	regsvr32.exe	27
PID 1580 wrote to memory of 840	1580	regsvr32.exe	27
PID 1580 wrote to memory of 840	1580	regsvr32.exe	27
PID 1580 wrote to memory of 840	1580	regsvr32.exe	27
PID 1580 wrote to memory of 840	1580	regsvr32.exe	27
PID 1580 wrote to memory of 840	1580	regsvr32.exe	27
PID 1580 wrote to memory of 840	1580	regsvr32.exe	27
PID 840 wrote to memory of 1540	840	regsvr32.exe	28
PID 840 wrote to memory of 1540	840	regsvr32.exe	28
PID 840 wrote to memory of 1540	840	regsvr32.exe	28
PID 840 wrote to memory of 1540	840	regsvr32.exe	28
PID 840 wrote to memory of 1540	840	regsvr32.exe	28
PID 840 wrote to memory of 1540	840	regsvr32.exe	28
PID 840 wrote to memory of 1540	840	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\kd9vBRH.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\kd9vBRH.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\kd9vBRH.dll",DllRegisterServer
    3⤵
    PID:1540

memory/840-56-0x00000000763F1000-0x00000000763F3000-memory.dmp

Download

memory/840-57-0x00000000001E0000-0x0000000000208000-memory.dmp

Download

memory/1580-55-0x000007FEFC031000-0x000007FEFC033000-memory.dmp

Download