46ff1f5f5bf88ae61adfa3ee24eebbeb02a4b2aa1ef958aa1f6c26dbb026ae7e

Analysis

Target
5d51a14149bd92ee3ef29526a629203d.dll
Size 254KB
Sample220202-tagtxaafar
SHA256 46ff1f5f5bf88ae61adfa3ee24eebbeb02a4b2aa1ef958aa1f6c26dbb026ae7e
MD5 5d51a14149bd92ee3ef29526a629203d
SHA1 5eeb4b3bb3ae3012a1e524556ce6370e650c1296
SHA512 6aa05f335f32ca93510512a35d5317c368e936b36c027f4bb06b026d98ece226e2c4c063792b3d0030a9046e50854533851f255e7d6e48df84e090dac9811e8c
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1356	1628	regsvr32.exe	27
PID 1628 wrote to memory of 1356	1628	regsvr32.exe	27
PID 1628 wrote to memory of 1356	1628	regsvr32.exe	27
PID 1628 wrote to memory of 1356	1628	regsvr32.exe	27
PID 1628 wrote to memory of 1356	1628	regsvr32.exe	27
PID 1628 wrote to memory of 1356	1628	regsvr32.exe	27
PID 1628 wrote to memory of 1356	1628	regsvr32.exe	27
PID 1356 wrote to memory of 884	1356	regsvr32.exe	28
PID 1356 wrote to memory of 884	1356	regsvr32.exe	28
PID 1356 wrote to memory of 884	1356	regsvr32.exe	28
PID 1356 wrote to memory of 884	1356	regsvr32.exe	28
PID 1356 wrote to memory of 884	1356	regsvr32.exe	28
PID 1356 wrote to memory of 884	1356	regsvr32.exe	28
PID 1356 wrote to memory of 884	1356	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5d51a14149bd92ee3ef29526a629203d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5d51a14149bd92ee3ef29526a629203d.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5d51a14149bd92ee3ef29526a629203d.dll",DllRegisterServer
    3⤵
    PID:884

memory/1356-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1628-54-0x000007FEFB711000-0x000007FEFB713000-memory.dmp

Download