f9ca1a567977ca058142f9c0f93a02172bdfcb24d59582838c3d362ea0f71579

Analysis

Target
183e994c3ff42e5af79cadc4baf79fef.dll
Size 254KB
Sample220202-vb9fzsbfd7
SHA256 f9ca1a567977ca058142f9c0f93a02172bdfcb24d59582838c3d362ea0f71579
MD5 183e994c3ff42e5af79cadc4baf79fef
SHA1 2e6921f5b644a33b99af22ebd14928dd1e50afd2
SHA512 dff0ab8738e478cc5636982b7746c797380678b6f1ae918360ce458c147312a184ff7068be1aedf7069dee77ca12eb1b39b9e4034a267e78b9c73a2cd1319989
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 612	1584	regsvr32.exe	27
PID 1584 wrote to memory of 612	1584	regsvr32.exe	27
PID 1584 wrote to memory of 612	1584	regsvr32.exe	27
PID 1584 wrote to memory of 612	1584	regsvr32.exe	27
PID 1584 wrote to memory of 612	1584	regsvr32.exe	27
PID 1584 wrote to memory of 612	1584	regsvr32.exe	27
PID 1584 wrote to memory of 612	1584	regsvr32.exe	27
PID 612 wrote to memory of 1180	612	regsvr32.exe	28
PID 612 wrote to memory of 1180	612	regsvr32.exe	28
PID 612 wrote to memory of 1180	612	regsvr32.exe	28
PID 612 wrote to memory of 1180	612	regsvr32.exe	28
PID 612 wrote to memory of 1180	612	regsvr32.exe	28
PID 612 wrote to memory of 1180	612	regsvr32.exe	28
PID 612 wrote to memory of 1180	612	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\183e994c3ff42e5af79cadc4baf79fef.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\183e994c3ff42e5af79cadc4baf79fef.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\183e994c3ff42e5af79cadc4baf79fef.dll",DllRegisterServer
    3⤵
    PID:1180

memory/612-56-0x0000000076921000-0x0000000076923000-memory.dmp

Download

memory/1584-55-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Download