3de90a25dfe3d17186bf81121be823ddd0eaf98a3ff324b4589c471a3f141cdf

Analysis

Target
e36ec0ba436d9ad31a2a001bc10e703b.dll
Size 596KB
Sample220125-wm15escef9
SHA256 3de90a25dfe3d17186bf81121be823ddd0eaf98a3ff324b4589c471a3f141cdf
MD5 e36ec0ba436d9ad31a2a001bc10e703b
SHA1 4e40288433b6d1995496c787d7adef42ccd986a4
SHA512 734e406a2ad17bc50f98bff08f9787ac0bd3f58aa43f12f52403bffaab0727ace4c5c2ff76941ecfbf3c361bc06ed9a6ec1cb1b7745cfdad7f25811cf6c5c86d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2564	2476	regsvr32.exe	68
PID 2476 wrote to memory of 2564	2476	regsvr32.exe	68
PID 2476 wrote to memory of 2564	2476	regsvr32.exe	68
PID 2564 wrote to memory of 3172	2564	regsvr32.exe	69
PID 2564 wrote to memory of 3172	2564	regsvr32.exe	69
PID 2564 wrote to memory of 3172	2564	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e36ec0ba436d9ad31a2a001bc10e703b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e36ec0ba436d9ad31a2a001bc10e703b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\e36ec0ba436d9ad31a2a001bc10e703b.dll",DllRegisterServer
    3⤵
    PID:3172