72534ec2c4fc2499e1f85e9149598d240177afc8b9e7b04e1df2abcf92a7b677

Analysis

Target
1.dll
Size 738KB
Sample220512-tqslcaeeal
SHA256 72534ec2c4fc2499e1f85e9149598d240177afc8b9e7b04e1df2abcf92a7b677
MD5 55ee6dca51e918bd51a000b0899e275a
SHA1 fea67687d4fd185246267305a76b53060407c7e9
SHA512 21cfbd951732096c86e19c19fd5cf916473279e3f452775d425689e148675a525a3c4ccda95e5ea298607c6325102bdc790b0465b55740adac5313dea57f9a13
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	26
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	26
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	26
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	26
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	26
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	26
PID 1472 wrote to memory of 1724	1472	regsvr32.exe	26
PID 1724 wrote to memory of 840	1724	regsvr32.exe	27
PID 1724 wrote to memory of 840	1724	regsvr32.exe	27
PID 1724 wrote to memory of 840	1724	regsvr32.exe	27
PID 1724 wrote to memory of 840	1724	regsvr32.exe	27
PID 1724 wrote to memory of 1956	1724	regsvr32.exe	28
PID 1724 wrote to memory of 1956	1724	regsvr32.exe	28
PID 1724 wrote to memory of 1956	1724	regsvr32.exe	28
PID 1724 wrote to memory of 1956	1724	regsvr32.exe	28
PID 1724 wrote to memory of 1956	1724	regsvr32.exe	28
PID 1724 wrote to memory of 1956	1724	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    PID:840
- - C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    3⤵
    PID:1956

memory/1472-54-0x000007FEFB971000-0x000007FEFB973000-memory.dmp

Download

memory/1724-56-0x0000000074F21000-0x0000000074F23000-memory.dmp

Download

memory/1724-57-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1724-58-0x0000000010000000-0x0000000010038000-memory.dmp

Download

memory/1724-59-0x0000000000130000-0x0000000000174000-memory.dmp

Download