bf09cac4d919e8616d7704b1500df74049d73fef77764cc16c23fa921eea7dd2

Analysis

Target
bf09cac4d919e8616d7704b1500df74049d73fef77764cc16c23fa921eea7dd2.dll
Size 716KB
Sample220124-jqedlsdfgl
SHA256 bf09cac4d919e8616d7704b1500df74049d73fef77764cc16c23fa921eea7dd2
MD5 6ee2bbdb2f152d239c6544ce5090283e
SHA1 118daba5065bca84248ff43487e69881386880ab
SHA512 cff80de7b908379734cda2ddbf696f7180688458371ff827c5c05e4b2b6b674095f2ccf4e1719f44e9d97d0240ff3bc18881d5c441132346da2a105772e9a073
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 2752	3196	regsvr32.exe	68
PID 3196 wrote to memory of 2752	3196	regsvr32.exe	68
PID 3196 wrote to memory of 2752	3196	regsvr32.exe	68
PID 2752 wrote to memory of 2372	2752	regsvr32.exe	69
PID 2752 wrote to memory of 2372	2752	regsvr32.exe	69
PID 2752 wrote to memory of 2372	2752	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bf09cac4d919e8616d7704b1500df74049d73fef77764cc16c23fa921eea7dd2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bf09cac4d919e8616d7704b1500df74049d73fef77764cc16c23fa921eea7dd2.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\bf09cac4d919e8616d7704b1500df74049d73fef77764cc16c23fa921eea7dd2.dll",DllRegisterServer
    3⤵
    PID:2372