eb9995bc762a0bc4c722db65fb83a9c8b8f9e40b3ed876940aa8e6dd374adb45

Analysis

Target
b7d93340b9c4ca9a1957238f7af1df8c.dll
Size 612KB
Sample220122-afgljsebh5
SHA256 eb9995bc762a0bc4c722db65fb83a9c8b8f9e40b3ed876940aa8e6dd374adb45
MD5 b7d93340b9c4ca9a1957238f7af1df8c
SHA1 9657e7a6bfea7d383a859c42cd8a8cce05b451c3
SHA512 c18a95a2c9ec11c4f72dfb07fe2ac5d701b4dfad58dec033aa3f6d7ffdaaa6cd3bd37d156eccb1b9503899c6799c7c78d80f05ca752bc749ac226a31ed326af9
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3696	3728	regsvr32.exe	69
PID 3728 wrote to memory of 3696	3728	regsvr32.exe	69
PID 3728 wrote to memory of 3696	3728	regsvr32.exe	69
PID 3696 wrote to memory of 1344	3696	regsvr32.exe	70
PID 3696 wrote to memory of 1344	3696	regsvr32.exe	70
PID 3696 wrote to memory of 1344	3696	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b7d93340b9c4ca9a1957238f7af1df8c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b7d93340b9c4ca9a1957238f7af1df8c.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b7d93340b9c4ca9a1957238f7af1df8c.dll",DllRegisterServer
    3⤵
    PID:1344