eebe2d2b5ea65d0698fab693d9d6b948a7927fa54c6014bfc826d1f74c80372c

Analysis

Target
33bg5kflUU.dll
Size 784KB
Sample220126-qk4vmsdec8
SHA256 eebe2d2b5ea65d0698fab693d9d6b948a7927fa54c6014bfc826d1f74c80372c
MD5 23b88afc14265d61810b88bbf65bcfbb
SHA1 1ddd841f12bb2226856347ed430024cf1976fb42
SHA512 63787bdea09eca428ebd037318db1a999a07033707351ff5a9b26217221eeda8ca5d42a9695406072b5ed4f018b61eb28e4498d9d59859af38f59f7ce1769418
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1608	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1608	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1608	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1608	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1608	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1608	1548	regsvr32.exe	27
PID 1548 wrote to memory of 1608	1548	regsvr32.exe	27
PID 1608 wrote to memory of 524	1608	regsvr32.exe	28
PID 1608 wrote to memory of 524	1608	regsvr32.exe	28
PID 1608 wrote to memory of 524	1608	regsvr32.exe	28
PID 1608 wrote to memory of 524	1608	regsvr32.exe	28
PID 1608 wrote to memory of 524	1608	regsvr32.exe	28
PID 1608 wrote to memory of 524	1608	regsvr32.exe	28
PID 1608 wrote to memory of 524	1608	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\33bg5kflUU.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\33bg5kflUU.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\33bg5kflUU.dll",DllRegisterServer
    3⤵
    PID:524

memory/1548-54-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

Download

memory/1608-55-0x0000000076451000-0x0000000076453000-memory.dmp

Download