c34693df28d82fd3246cc015c86b37ee68a65632430bae2bd7c2add815e809f3

Analysis

Target
94b9c4c32cbc78bcf6a4fe8e472989ac.dll
Size 254KB
Sample220202-xmhhrabch8
SHA256 c34693df28d82fd3246cc015c86b37ee68a65632430bae2bd7c2add815e809f3
MD5 94b9c4c32cbc78bcf6a4fe8e472989ac
SHA1 05d5168eb21e98ff4bf89dd97968d5173a876fe8
SHA512 b01e9ed77df2c93b9c66baeb24e545194079ea803add9248abfaeff292982063a5f258a3b4a304f5dcdd88ef75c478259257220055c7e520322dc425b9893bec
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2040	928	regsvr32.exe	27
PID 928 wrote to memory of 2040	928	regsvr32.exe	27
PID 928 wrote to memory of 2040	928	regsvr32.exe	27
PID 928 wrote to memory of 2040	928	regsvr32.exe	27
PID 928 wrote to memory of 2040	928	regsvr32.exe	27
PID 928 wrote to memory of 2040	928	regsvr32.exe	27
PID 928 wrote to memory of 2040	928	regsvr32.exe	27
PID 2040 wrote to memory of 2036	2040	regsvr32.exe	28
PID 2040 wrote to memory of 2036	2040	regsvr32.exe	28
PID 2040 wrote to memory of 2036	2040	regsvr32.exe	28
PID 2040 wrote to memory of 2036	2040	regsvr32.exe	28
PID 2040 wrote to memory of 2036	2040	regsvr32.exe	28
PID 2040 wrote to memory of 2036	2040	regsvr32.exe	28
PID 2040 wrote to memory of 2036	2040	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\94b9c4c32cbc78bcf6a4fe8e472989ac.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\94b9c4c32cbc78bcf6a4fe8e472989ac.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\94b9c4c32cbc78bcf6a4fe8e472989ac.dll",DllRegisterServer
    3⤵
    PID:2036

memory/928-55-0x000007FEFC3A1000-0x000007FEFC3A3000-memory.dmp

Download

memory/2040-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Download