4890fa2f24374911bf4017da74dd124f2f13af60d398b95000cd5172b4bac65a

Analysis

Target
8b64e711b0895323e12d96f83f0abba8.dll
Size 705KB
Sample220126-rraqtaeca6
SHA256 4890fa2f24374911bf4017da74dd124f2f13af60d398b95000cd5172b4bac65a
MD5 8b64e711b0895323e12d96f83f0abba8
SHA1 9276578a2d4d8de24560cc313eaaa46904bce208
SHA512 c65e8f7a14f9020873f3a68ba92bd66d46d68c75c3a58f2ab4ab1d69d45651e4a0c6f23e9017512bddcc7a755e8de1e7c9f1a09044e75043aa39dd760628e697
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 628	868	regsvr32.exe	27
PID 868 wrote to memory of 628	868	regsvr32.exe	27
PID 868 wrote to memory of 628	868	regsvr32.exe	27
PID 868 wrote to memory of 628	868	regsvr32.exe	27
PID 868 wrote to memory of 628	868	regsvr32.exe	27
PID 868 wrote to memory of 628	868	regsvr32.exe	27
PID 868 wrote to memory of 628	868	regsvr32.exe	27
PID 628 wrote to memory of 864	628	regsvr32.exe	28
PID 628 wrote to memory of 864	628	regsvr32.exe	28
PID 628 wrote to memory of 864	628	regsvr32.exe	28
PID 628 wrote to memory of 864	628	regsvr32.exe	28
PID 628 wrote to memory of 864	628	regsvr32.exe	28
PID 628 wrote to memory of 864	628	regsvr32.exe	28
PID 628 wrote to memory of 864	628	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8b64e711b0895323e12d96f83f0abba8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8b64e711b0895323e12d96f83f0abba8.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8b64e711b0895323e12d96f83f0abba8.dll",DllRegisterServer
    3⤵
    PID:864

memory/628-55-0x0000000075761000-0x0000000075763000-memory.dmp

Download

memory/868-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download