54b6c3f777babb0c22331a8c3f73abb91241d8ec03e9aac86cca35b87cb22a39

Analysis

Target
354de2afdc4f53721358d4b6dfcffa16.dll
Size 254KB
Sample220202-ng5xesabc6
SHA256 54b6c3f777babb0c22331a8c3f73abb91241d8ec03e9aac86cca35b87cb22a39
MD5 354de2afdc4f53721358d4b6dfcffa16
SHA1 2ddedbde580e01109f2f6121e454a12f7d82fa34
SHA512 8b3745eff5b313f81919c30322207eba1b713a72bc4deb94565b1e35436026eef79ac2e3b2e7ff6b82cfd7325a9621e21104a9125726e6aa15dd653f42dbf6cc
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1576	1756	regsvr32.exe	27
PID 1756 wrote to memory of 1576	1756	regsvr32.exe	27
PID 1756 wrote to memory of 1576	1756	regsvr32.exe	27
PID 1756 wrote to memory of 1576	1756	regsvr32.exe	27
PID 1756 wrote to memory of 1576	1756	regsvr32.exe	27
PID 1756 wrote to memory of 1576	1756	regsvr32.exe	27
PID 1756 wrote to memory of 1576	1756	regsvr32.exe	27
PID 1576 wrote to memory of 892	1576	regsvr32.exe	28
PID 1576 wrote to memory of 892	1576	regsvr32.exe	28
PID 1576 wrote to memory of 892	1576	regsvr32.exe	28
PID 1576 wrote to memory of 892	1576	regsvr32.exe	28
PID 1576 wrote to memory of 892	1576	regsvr32.exe	28
PID 1576 wrote to memory of 892	1576	regsvr32.exe	28
PID 1576 wrote to memory of 892	1576	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\354de2afdc4f53721358d4b6dfcffa16.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\354de2afdc4f53721358d4b6dfcffa16.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\354de2afdc4f53721358d4b6dfcffa16.dll",DllRegisterServer
    3⤵
    PID:892

memory/1576-55-0x0000000076451000-0x0000000076453000-memory.dmp

Download

memory/1756-54-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

Download