7c2e89427485c55ae688604de70e60fdbe603bd155b53168dc09284e1aee9827

Analysis

Target
DXXalH0ru169YZUM5.dll
Size 784KB
Sample220126-yleadaaae2
SHA256 7c2e89427485c55ae688604de70e60fdbe603bd155b53168dc09284e1aee9827
MD5 7474122c1affb90327d9fa14bf5f99dc
SHA1 49a5e5561cbda0bd3aeccc9d5972e9c4f816f288
SHA512 94ff3498320a828d3500e2063c5f835e1a4440388eea60e509aab386c82ead0844b5ec1a0ff431ec08e2091d1d74482699584802b909c709cd6dd6a61b5e32aa
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1776 wrote to memory of 1896	1776	regsvr32.exe	27
PID 1896 wrote to memory of 672	1896	regsvr32.exe	28
PID 1896 wrote to memory of 672	1896	regsvr32.exe	28
PID 1896 wrote to memory of 672	1896	regsvr32.exe	28
PID 1896 wrote to memory of 672	1896	regsvr32.exe	28
PID 1896 wrote to memory of 672	1896	regsvr32.exe	28
PID 1896 wrote to memory of 672	1896	regsvr32.exe	28
PID 1896 wrote to memory of 672	1896	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DXXalH0ru169YZUM5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\DXXalH0ru169YZUM5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\DXXalH0ru169YZUM5.dll",DllRegisterServer
    3⤵
    PID:672

memory/1776-54-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Download

memory/1896-55-0x0000000076C61000-0x0000000076C63000-memory.dmp

Download