13d4b0a9ac967ca0e031dfacc4ce705c350fead8fa151e2fd9765e4d86ed634c

Analysis

Target
YXKGxUdd3Kxq.dll
Size 254KB
Sample220202-ppmw9aach2
SHA256 13d4b0a9ac967ca0e031dfacc4ce705c350fead8fa151e2fd9765e4d86ed634c
MD5 1facf465dc531cfd1e7a9e9cc0cb3ac4
SHA1 3d2c4eb5d67e7839fbdfc63ea0affbe0c1858904
SHA512 a969d61019e38733a432a311714a19fb87cdb031ffc38b6fe300aaaa14e1e69a5972eb8ab598687495d4178135042a1870cd0c4fce4147bc199cb4866902abe7
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1364	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1364	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1364	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1364	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1364	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1364	1572	regsvr32.exe	27
PID 1572 wrote to memory of 1364	1572	regsvr32.exe	27
PID 1364 wrote to memory of 268	1364	regsvr32.exe	28
PID 1364 wrote to memory of 268	1364	regsvr32.exe	28
PID 1364 wrote to memory of 268	1364	regsvr32.exe	28
PID 1364 wrote to memory of 268	1364	regsvr32.exe	28
PID 1364 wrote to memory of 268	1364	regsvr32.exe	28
PID 1364 wrote to memory of 268	1364	regsvr32.exe	28
PID 1364 wrote to memory of 268	1364	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\YXKGxUdd3Kxq.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\YXKGxUdd3Kxq.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\YXKGxUdd3Kxq.dll",DllRegisterServer
    3⤵
    PID:268

memory/1364-55-0x0000000076911000-0x0000000076913000-memory.dmp

Download

memory/1572-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Download