c8c14453e131c61ab6a3cfa38e8edfadf2ca15036c32f1ca781393d0b3579e65

Analysis

Target
7d9b6aad356b7d4bf7049ffe26e963af.dll
Size 642KB
Sample220125-ld7whadaam
SHA256 c8c14453e131c61ab6a3cfa38e8edfadf2ca15036c32f1ca781393d0b3579e65
MD5 7d9b6aad356b7d4bf7049ffe26e963af
SHA1 f1c16e95fa6581bc134e077ebdb8d48b2c9a0301
SHA512 09b6a790743c699ea3844b47d7b4d7e52353e079e2b10428e2df37d02797fd0c515e70100df6b8ffc3f05bd806c48556a108456f3e565cb49cd451e01621bc2b
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2800	2756	regsvr32.exe	69
PID 2756 wrote to memory of 2800	2756	regsvr32.exe	69
PID 2756 wrote to memory of 2800	2756	regsvr32.exe	69
PID 2800 wrote to memory of 3468	2800	regsvr32.exe	70
PID 2800 wrote to memory of 3468	2800	regsvr32.exe	70
PID 2800 wrote to memory of 3468	2800	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7d9b6aad356b7d4bf7049ffe26e963af.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7d9b6aad356b7d4bf7049ffe26e963af.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7d9b6aad356b7d4bf7049ffe26e963af.dll",DllRegisterServer
    3⤵
    PID:3468