eeffa2cea4afb12a36f5b4e3cff953c1ef698bbb3ed8871a79830d697badef0b

Analysis

Target
7ZWBlYgLP1.dll
Size 660KB
Sample220125-t91fasbcg8
SHA256 eeffa2cea4afb12a36f5b4e3cff953c1ef698bbb3ed8871a79830d697badef0b
MD5 ea1b500e60ccf75c17a77343daf4d7fd
SHA1 198a6a6374b5599d36bca6aa3bce7e496ac948dc
SHA512 404b71d37d69ef49b1d6802118ed1dfe2d839336467b3676e9c63208f55ad2544d2eae1fc7c23e58cf5c4eceeffcb082e08f141a98bc083dcbbc083aae87827c
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1664	952	regsvr32.exe	27
PID 952 wrote to memory of 1664	952	regsvr32.exe	27
PID 952 wrote to memory of 1664	952	regsvr32.exe	27
PID 952 wrote to memory of 1664	952	regsvr32.exe	27
PID 952 wrote to memory of 1664	952	regsvr32.exe	27
PID 952 wrote to memory of 1664	952	regsvr32.exe	27
PID 952 wrote to memory of 1664	952	regsvr32.exe	27
PID 1664 wrote to memory of 896	1664	regsvr32.exe	28
PID 1664 wrote to memory of 896	1664	regsvr32.exe	28
PID 1664 wrote to memory of 896	1664	regsvr32.exe	28
PID 1664 wrote to memory of 896	1664	regsvr32.exe	28
PID 1664 wrote to memory of 896	1664	regsvr32.exe	28
PID 1664 wrote to memory of 896	1664	regsvr32.exe	28
PID 1664 wrote to memory of 896	1664	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7ZWBlYgLP1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7ZWBlYgLP1.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7ZWBlYgLP1.dll",DllRegisterServer
    3⤵
    PID:896

memory/952-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Download

memory/1664-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Download