61bbc1907b1207aa2de868034febbce3870d79206401e43203e8ceff6e18e0e2

Analysis

Target
33dc99c26ebac440e75b3f9119aef850.dll
Size 784KB
Sample220126-wtqx2aghc7
SHA256 61bbc1907b1207aa2de868034febbce3870d79206401e43203e8ceff6e18e0e2
MD5 33dc99c26ebac440e75b3f9119aef850
SHA1 60592ce25849695a8baac8e762fccb9b2a177cd3
SHA512 7bd3b4db3368a54b15d634f71317b6c3e0c30e1a746538a73d80d9b527a31c830a523be66953cc3cdbbbf1076c0447e931e8490e638b5b1332a46bae3c8e9ef4
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1672	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1672	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1672	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1672	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1672	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1672	1316	regsvr32.exe	27
PID 1316 wrote to memory of 1672	1316	regsvr32.exe	27
PID 1672 wrote to memory of 576	1672	regsvr32.exe	28
PID 1672 wrote to memory of 576	1672	regsvr32.exe	28
PID 1672 wrote to memory of 576	1672	regsvr32.exe	28
PID 1672 wrote to memory of 576	1672	regsvr32.exe	28
PID 1672 wrote to memory of 576	1672	regsvr32.exe	28
PID 1672 wrote to memory of 576	1672	regsvr32.exe	28
PID 1672 wrote to memory of 576	1672	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\33dc99c26ebac440e75b3f9119aef850.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\33dc99c26ebac440e75b3f9119aef850.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\33dc99c26ebac440e75b3f9119aef850.dll",DllRegisterServer
    3⤵
    PID:576

memory/1316-55-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Download

memory/1672-56-0x0000000074B21000-0x0000000074B23000-memory.dmp

Download