3641b243f2ab602a4e201cd64238b3690d26750d7d5dec2046bb8fdc43d69cc0

Analysis

Target
f872a9d57c57493f2e78d71f8c0e4176.dll
Size 636KB
Sample220121-nevcxacfgk
SHA256 3641b243f2ab602a4e201cd64238b3690d26750d7d5dec2046bb8fdc43d69cc0
MD5 f872a9d57c57493f2e78d71f8c0e4176
SHA1 5a0af17f4180913ab2a22bb6521c0d4cba331de3
SHA512 7134e49a3ddde822e414f5e3c19f1d38f8526cc2690e24b488383e57c6e5100cd54158ebaabc65bdb6c2d23be9d61f343b4236210590ff9cc179ef7e395679d7
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 2324	3764	regsvr32.exe	69
PID 3764 wrote to memory of 2324	3764	regsvr32.exe	69
PID 3764 wrote to memory of 2324	3764	regsvr32.exe	69
PID 2324 wrote to memory of 3088	2324	regsvr32.exe	70
PID 2324 wrote to memory of 3088	2324	regsvr32.exe	70
PID 2324 wrote to memory of 3088	2324	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f872a9d57c57493f2e78d71f8c0e4176.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f872a9d57c57493f2e78d71f8c0e4176.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f872a9d57c57493f2e78d71f8c0e4176.dll",DllRegisterServer
    3⤵
    PID:3088