739e0ab9c23e1fdfdd1317d38db19daee4c2e52df7eeb468049c269737c21926

Analysis

Target
5hxH8zgG0UguDIA8OI.dll
Size 988KB
Sample220203-k2swtafab2
SHA256 739e0ab9c23e1fdfdd1317d38db19daee4c2e52df7eeb468049c269737c21926
MD5 536b9bcb902a0b6063ff2f1e19760a16
SHA1 ad422cff4f69d64f568a47fdc23504c4d875c70b
SHA512 57d2d2dd851922c9595e8ea137de4ad0697c4de65a984da5a3cd610235e26a0a65c45b023b702ad78da5f7c71638e1d2721959c3a82ee224c0daca2cc0a7f90d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1376	2036	regsvr32.exe	27
PID 2036 wrote to memory of 1376	2036	regsvr32.exe	27
PID 2036 wrote to memory of 1376	2036	regsvr32.exe	27
PID 2036 wrote to memory of 1376	2036	regsvr32.exe	27
PID 2036 wrote to memory of 1376	2036	regsvr32.exe	27
PID 2036 wrote to memory of 1376	2036	regsvr32.exe	27
PID 2036 wrote to memory of 1376	2036	regsvr32.exe	27
PID 1376 wrote to memory of 1636	1376	regsvr32.exe	28
PID 1376 wrote to memory of 1636	1376	regsvr32.exe	28
PID 1376 wrote to memory of 1636	1376	regsvr32.exe	28
PID 1376 wrote to memory of 1636	1376	regsvr32.exe	28
PID 1376 wrote to memory of 1636	1376	regsvr32.exe	28
PID 1376 wrote to memory of 1636	1376	regsvr32.exe	28
PID 1376 wrote to memory of 1636	1376	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5hxH8zgG0UguDIA8OI.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5hxH8zgG0UguDIA8OI.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5hxH8zgG0UguDIA8OI.dll",DllRegisterServer
    3⤵
    PID:1636

memory/1376-56-0x0000000076851000-0x0000000076853000-memory.dmp

Download

memory/2036-55-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Download