2059dcafd15a1d23ec459d44e340547388bf7bbe1edf60aaa4c49a2986425569

Analysis

Target
c4cf1e2557ff4553209b402d827e9961.dll
Size 596KB
Sample220125-wsllxscff7
SHA256 2059dcafd15a1d23ec459d44e340547388bf7bbe1edf60aaa4c49a2986425569
MD5 c4cf1e2557ff4553209b402d827e9961
SHA1 9f32713c5518f236660db4b21fdf7e975f80f3b1
SHA512 3dc8b5afd2bc9f4efe059021f07889f449769dee78330e8bfbf5b79ef6477e8ff19bd1bd076ecf6ede1d2e9f4632212425f05e6c8a42d73abcfe647b7522fae0
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2828	2772	regsvr32.exe	68
PID 2772 wrote to memory of 2828	2772	regsvr32.exe	68
PID 2772 wrote to memory of 2828	2772	regsvr32.exe	68
PID 2828 wrote to memory of 3968	2828	regsvr32.exe	69
PID 2828 wrote to memory of 3968	2828	regsvr32.exe	69
PID 2828 wrote to memory of 3968	2828	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c4cf1e2557ff4553209b402d827e9961.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c4cf1e2557ff4553209b402d827e9961.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c4cf1e2557ff4553209b402d827e9961.dll",DllRegisterServer
    3⤵
    PID:3968