dc2b36a39e44ba8371e137d53dcfe7af346a4da6be4ec5531ef0ef2cb2f3c922

Resubmissions

18-01-2022 01:59

18-01-2022 01:25

12-01-2022 19:02

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	Process	procid_target
PID 632 wrote to memory of 1108	632	regsvr32.exe	52
PID 632 wrote to memory of 1108	632	regsvr32.exe	52
PID 632 wrote to memory of 1108	632	regsvr32.exe	52

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\wTX6pg5eI.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\wTX6pg5eI.dll
  2⤵
  PID:1108