dc2b36a39e44ba8371e137d53dcfe7af346a4da6be4ec5531ef0ef2cb2f3c922

Resubmissions

18-01-2022 01:59

18-01-2022 01:25

12-01-2022 19:02

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 632 wrote to memory of 1108	632	regsvr32.exe	regsvr32.exe
PID 632 wrote to memory of 1108	632	regsvr32.exe	regsvr32.exe
PID 632 wrote to memory of 1108	632	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\wTX6pg5eI.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\wTX6pg5eI.dll
2⤵
PID:1108