e73c1e8bc19cc3b4c77c39fa58e83b014459df33e03cf7bb9f9946bee0c44267

Analysis

Target
3041f68ba28ae1ef63f9b75747a53ca7.dll
Size 676KB
Sample220124-18hmesbchk
SHA256 e73c1e8bc19cc3b4c77c39fa58e83b014459df33e03cf7bb9f9946bee0c44267
MD5 3041f68ba28ae1ef63f9b75747a53ca7
SHA1 650a8b8a687b948d49657f9acf1bb33eadf76dda
SHA512 6d5190b6a8c32a29ca5062e4706ba586c81aebf01896b040eaee15def0b7375d2c3eb51fa4a22c629827d3275bf0085430a7771648890270d36b39d04b61146f
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2656	2640	regsvr32.exe	68
PID 2640 wrote to memory of 2656	2640	regsvr32.exe	68
PID 2640 wrote to memory of 2656	2640	regsvr32.exe	68
PID 2656 wrote to memory of 3688	2656	regsvr32.exe	69
PID 2656 wrote to memory of 3688	2656	regsvr32.exe	69
PID 2656 wrote to memory of 3688	2656	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3041f68ba28ae1ef63f9b75747a53ca7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3041f68ba28ae1ef63f9b75747a53ca7.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3041f68ba28ae1ef63f9b75747a53ca7.dll",DllRegisterServer
    3⤵
    PID:3688