eeffa2cea4afb12a36f5b4e3cff953c1ef698bbb3ed8871a79830d697badef0b

Analysis

Target
7ZWBlYgLP1.dll
Size 660KB
Sample220125-t91fasbcg8
SHA256 eeffa2cea4afb12a36f5b4e3cff953c1ef698bbb3ed8871a79830d697badef0b
MD5 ea1b500e60ccf75c17a77343daf4d7fd
SHA1 198a6a6374b5599d36bca6aa3bce7e496ac948dc
SHA512 404b71d37d69ef49b1d6802118ed1dfe2d839336467b3676e9c63208f55ad2544d2eae1fc7c23e58cf5c4eceeffcb082e08f141a98bc083dcbbc083aae87827c
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4192	4160	regsvr32.exe	69
PID 4160 wrote to memory of 4192	4160	regsvr32.exe	69
PID 4160 wrote to memory of 4192	4160	regsvr32.exe	69
PID 4192 wrote to memory of 4496	4192	regsvr32.exe	70
PID 4192 wrote to memory of 4496	4192	regsvr32.exe	70
PID 4192 wrote to memory of 4496	4192	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7ZWBlYgLP1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7ZWBlYgLP1.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7ZWBlYgLP1.dll",DllRegisterServer
    3⤵
    PID:4496