4f6b93bdfac2d717a86bedd7e9494e5a312dcd09e8e4bbd9cc53ff73bbc6529e

Analysis

Target
1c7449041211074ef3fbe9b7041590d3.dll
Size 520KB
Sample220201-ytvmbsbbej
SHA256 4f6b93bdfac2d717a86bedd7e9494e5a312dcd09e8e4bbd9cc53ff73bbc6529e
MD5 1c7449041211074ef3fbe9b7041590d3
SHA1 f76d5ddfc992a38f6d5d76376ba04da90076f8bf
SHA512 60c70fc1508cf0414bff97a0bcb55edfb0c468786bcc6c00edd1e865f8286cbadbde33463fa2c4b202a248971fce93337df9c997000f1c10ee41b60a49de001f
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 268 wrote to memory of 588	268	regsvr32.exe	27
PID 268 wrote to memory of 588	268	regsvr32.exe	27
PID 268 wrote to memory of 588	268	regsvr32.exe	27
PID 268 wrote to memory of 588	268	regsvr32.exe	27
PID 268 wrote to memory of 588	268	regsvr32.exe	27
PID 268 wrote to memory of 588	268	regsvr32.exe	27
PID 268 wrote to memory of 588	268	regsvr32.exe	27
PID 588 wrote to memory of 776	588	regsvr32.exe	28
PID 588 wrote to memory of 776	588	regsvr32.exe	28
PID 588 wrote to memory of 776	588	regsvr32.exe	28
PID 588 wrote to memory of 776	588	regsvr32.exe	28
PID 588 wrote to memory of 776	588	regsvr32.exe	28
PID 588 wrote to memory of 776	588	regsvr32.exe	28
PID 588 wrote to memory of 776	588	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1c7449041211074ef3fbe9b7041590d3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:268
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1c7449041211074ef3fbe9b7041590d3.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:588
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1c7449041211074ef3fbe9b7041590d3.dll",DllRegisterServer
    3⤵
    PID:776

memory/268-54-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Download

memory/588-55-0x00000000751B1000-0x00000000751B3000-memory.dmp

Download