14132aa34ecf5adb006f2be035488838b09985c6c48aee198d3871369e2eeeae

Analysis

Target
CF8PDpl9Nf7xM.dll
Size 496KB
Sample220127-khnsraacb2
SHA256 14132aa34ecf5adb006f2be035488838b09985c6c48aee198d3871369e2eeeae
MD5 a9bd563bbd2982c7a3602157dfc7a15d
SHA1 f1f9f107905d9cb4066a228dde8380c338dc893a
SHA512 e23954c19300396a16d3e343c3a9686704c5827307fea442dc7afd55dd76623ec9c6e912eb64be3ac73eceb338144c79446460ce1887eb3242ba491a175bea59
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 952	1660	regsvr32.exe	27
PID 1660 wrote to memory of 952	1660	regsvr32.exe	27
PID 1660 wrote to memory of 952	1660	regsvr32.exe	27
PID 1660 wrote to memory of 952	1660	regsvr32.exe	27
PID 1660 wrote to memory of 952	1660	regsvr32.exe	27
PID 1660 wrote to memory of 952	1660	regsvr32.exe	27
PID 1660 wrote to memory of 952	1660	regsvr32.exe	27
PID 952 wrote to memory of 760	952	regsvr32.exe	28
PID 952 wrote to memory of 760	952	regsvr32.exe	28
PID 952 wrote to memory of 760	952	regsvr32.exe	28
PID 952 wrote to memory of 760	952	regsvr32.exe	28
PID 952 wrote to memory of 760	952	regsvr32.exe	28
PID 952 wrote to memory of 760	952	regsvr32.exe	28
PID 952 wrote to memory of 760	952	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CF8PDpl9Nf7xM.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\CF8PDpl9Nf7xM.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CF8PDpl9Nf7xM.dll",DllRegisterServer
    3⤵
    PID:760

memory/952-56-0x0000000076141000-0x0000000076143000-memory.dmp

Download

memory/1660-55-0x000007FEFC0E1000-0x000007FEFC0E3000-memory.dmp

Download