7d6cbfe9afb914f8418937733856486153651d862d734e7c0fe0d9a25998237e

Analysis

Target
8Y5Maeb1dsuKt3xi.dll
Size 254KB
Sample220202-sdblmaadcl
SHA256 7d6cbfe9afb914f8418937733856486153651d862d734e7c0fe0d9a25998237e
MD5 d1c6057ac75f6b96e3a3fc6ba1139e88
SHA1 b9029ce6d75c0217fa8517dffa4af08b719cbf9d
SHA512 76c600df8ce1189cc34e20b45ec0d1dd6c0e8f44431c592066f0874677303690ec69b0d4b1f27624d3b9a030270511adf1daeab752da5a2f7da94b50dede35b0
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1252	852	regsvr32.exe	27
PID 852 wrote to memory of 1252	852	regsvr32.exe	27
PID 852 wrote to memory of 1252	852	regsvr32.exe	27
PID 852 wrote to memory of 1252	852	regsvr32.exe	27
PID 852 wrote to memory of 1252	852	regsvr32.exe	27
PID 852 wrote to memory of 1252	852	regsvr32.exe	27
PID 852 wrote to memory of 1252	852	regsvr32.exe	27
PID 1252 wrote to memory of 1136	1252	regsvr32.exe	28
PID 1252 wrote to memory of 1136	1252	regsvr32.exe	28
PID 1252 wrote to memory of 1136	1252	regsvr32.exe	28
PID 1252 wrote to memory of 1136	1252	regsvr32.exe	28
PID 1252 wrote to memory of 1136	1252	regsvr32.exe	28
PID 1252 wrote to memory of 1136	1252	regsvr32.exe	28
PID 1252 wrote to memory of 1136	1252	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8Y5Maeb1dsuKt3xi.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8Y5Maeb1dsuKt3xi.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8Y5Maeb1dsuKt3xi.dll",DllRegisterServer
    3⤵
    PID:1136

memory/852-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download

memory/1252-55-0x0000000075761000-0x0000000075763000-memory.dmp

Download