3364a1fad21b56269eb7d4ee9edcc7fc41bde56a3cbfb1462096b09f140ad49b

Analysis

Target
dc90f8831cacefce583e91710b891239.dll
Size 512KB
Sample220127-2sv39acfe5
SHA256 3364a1fad21b56269eb7d4ee9edcc7fc41bde56a3cbfb1462096b09f140ad49b
MD5 dc90f8831cacefce583e91710b891239
SHA1 295bea1a74c95b73fbddc6a02309e8f06c52b35d
SHA512 8be95d59c2bea29732aa3d10a298043b3b75473af94d3c326b9b7690ec5bdc3eb7d364ab6241a4f1adb318a149ff5284ad2d2005b53aa868ef8a238ed356e2e9
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1892	1088	regsvr32.exe	27
PID 1088 wrote to memory of 1892	1088	regsvr32.exe	27
PID 1088 wrote to memory of 1892	1088	regsvr32.exe	27
PID 1088 wrote to memory of 1892	1088	regsvr32.exe	27
PID 1088 wrote to memory of 1892	1088	regsvr32.exe	27
PID 1088 wrote to memory of 1892	1088	regsvr32.exe	27
PID 1088 wrote to memory of 1892	1088	regsvr32.exe	27
PID 1892 wrote to memory of 584	1892	regsvr32.exe	28
PID 1892 wrote to memory of 584	1892	regsvr32.exe	28
PID 1892 wrote to memory of 584	1892	regsvr32.exe	28
PID 1892 wrote to memory of 584	1892	regsvr32.exe	28
PID 1892 wrote to memory of 584	1892	regsvr32.exe	28
PID 1892 wrote to memory of 584	1892	regsvr32.exe	28
PID 1892 wrote to memory of 584	1892	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dc90f8831cacefce583e91710b891239.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dc90f8831cacefce583e91710b891239.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\dc90f8831cacefce583e91710b891239.dll",DllRegisterServer
    3⤵
    PID:584

memory/1088-53-0x000007FEFC321000-0x000007FEFC323000-memory.dmp

Download

memory/1892-54-0x0000000076C61000-0x0000000076C63000-memory.dmp

Download