431eb5f888d206f339e4b08c6c58c6a2f4a31089cc22ca50e807b8f043cc35ba

Analysis

Target
triage_dropped_file.dll
Size 408KB
Sample220119-rrv2raafc8
SHA256 431eb5f888d206f339e4b08c6c58c6a2f4a31089cc22ca50e807b8f043cc35ba
MD5 e5c52d2c8398b786ab1756761410b15e
SHA1 6d1e064d4d51c5596ed6534fc5d7d8ddd1e70bb5
SHA512 352e29e895a842460cf48842db35a0519c890898758959caafccaa969d3eab67b5a672bfb55393bac3e0d63d79b51af84e79b1e5a2095551a1d9921f25931565
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 612	1408	regsvr32.exe	27
PID 1408 wrote to memory of 612	1408	regsvr32.exe	27
PID 1408 wrote to memory of 612	1408	regsvr32.exe	27
PID 1408 wrote to memory of 612	1408	regsvr32.exe	27
PID 1408 wrote to memory of 612	1408	regsvr32.exe	27
PID 1408 wrote to memory of 612	1408	regsvr32.exe	27
PID 1408 wrote to memory of 612	1408	regsvr32.exe	27
PID 612 wrote to memory of 1680	612	regsvr32.exe	28
PID 612 wrote to memory of 1680	612	regsvr32.exe	28
PID 612 wrote to memory of 1680	612	regsvr32.exe	28
PID 612 wrote to memory of 1680	612	regsvr32.exe	28
PID 612 wrote to memory of 1680	612	regsvr32.exe	28
PID 612 wrote to memory of 1680	612	regsvr32.exe	28
PID 612 wrote to memory of 1680	612	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.dll",DllRegisterServer
    3⤵
    PID:1680

memory/612-55-0x0000000075891000-0x0000000075893000-memory.dmp

Download

memory/1408-54-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp

Download