6e44afa1bdb754a9fa4f3b71d91f7a6df03b221cbf518db09a93c1b68a5dc59b

Analysis

Target
cb3cdcbd49ee08e1a7b78a77efd831eb.dll
Size 254KB
Sample220202-m7ex9aabb4
SHA256 6e44afa1bdb754a9fa4f3b71d91f7a6df03b221cbf518db09a93c1b68a5dc59b
MD5 cb3cdcbd49ee08e1a7b78a77efd831eb
SHA1 d9196fc88416f3a2a32d6091c5f0042ebf201f5f
SHA512 ebfa838104bc981062310a7b14b8b45c91fda77424e2a0c5fd390687d67e1aa6aa77b71aadf942f6f6eab01f5f56c1e2acac3ea2b73f864b54f81d5a49d36418
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1544	1072	regsvr32.exe	27
PID 1072 wrote to memory of 1544	1072	regsvr32.exe	27
PID 1072 wrote to memory of 1544	1072	regsvr32.exe	27
PID 1072 wrote to memory of 1544	1072	regsvr32.exe	27
PID 1072 wrote to memory of 1544	1072	regsvr32.exe	27
PID 1072 wrote to memory of 1544	1072	regsvr32.exe	27
PID 1072 wrote to memory of 1544	1072	regsvr32.exe	27
PID 1544 wrote to memory of 652	1544	regsvr32.exe	28
PID 1544 wrote to memory of 652	1544	regsvr32.exe	28
PID 1544 wrote to memory of 652	1544	regsvr32.exe	28
PID 1544 wrote to memory of 652	1544	regsvr32.exe	28
PID 1544 wrote to memory of 652	1544	regsvr32.exe	28
PID 1544 wrote to memory of 652	1544	regsvr32.exe	28
PID 1544 wrote to memory of 652	1544	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cb3cdcbd49ee08e1a7b78a77efd831eb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cb3cdcbd49ee08e1a7b78a77efd831eb.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\cb3cdcbd49ee08e1a7b78a77efd831eb.dll",DllRegisterServer
    3⤵
    PID:652

memory/1072-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Download

memory/1544-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download