aef7d8cb8844c235a0cf77ca8c011441e64e977aeff4be69b4f38e184d634301

Analysis

Target
5d78b4148f0bcd5023741447e04f9056.dll
Size 780KB
Sample220125-jvz6wabffm
SHA256 aef7d8cb8844c235a0cf77ca8c011441e64e977aeff4be69b4f38e184d634301
MD5 5d78b4148f0bcd5023741447e04f9056
SHA1 0d959a32709e9592f2aa1307e596dbae25857acc
SHA512 8e1475296316e6118c45b28586d537c0c19f41074d63e9d940d19ccd6317f96f772865a98755b0ca1011dd410803730c3bb9282fbf63dc56562f7951885acbe3
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3480	3448	regsvr32.exe	69
PID 3448 wrote to memory of 3480	3448	regsvr32.exe	69
PID 3448 wrote to memory of 3480	3448	regsvr32.exe	69
PID 3480 wrote to memory of 3052	3480	regsvr32.exe	70
PID 3480 wrote to memory of 3052	3480	regsvr32.exe	70
PID 3480 wrote to memory of 3052	3480	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5d78b4148f0bcd5023741447e04f9056.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5d78b4148f0bcd5023741447e04f9056.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5d78b4148f0bcd5023741447e04f9056.dll",DllRegisterServer
    3⤵
    PID:3052