c4ab0b6d1d76cede07b0c1565cc04a76cc9d609df5ec28f3d7b3450c01777765

Analysis

Target
042cae5a9ecd942f35f652c5ed068bd1.dll
Size 496KB
Sample220126-1fyg6sbbc8
SHA256 c4ab0b6d1d76cede07b0c1565cc04a76cc9d609df5ec28f3d7b3450c01777765
MD5 042cae5a9ecd942f35f652c5ed068bd1
SHA1 555bd8e0b8ed01c1e01d2477e447dc881d19a9f3
SHA512 a99303bcdf5a7b1cf4f64086a920a54c19e6d4f5e5aa9845349e763934511154fd1c7ce5f3f8a10979597a207cadf3de9701872023fcf22dc0fad6e1e8af7fb2
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2772	2608	regsvr32.exe	68
PID 2608 wrote to memory of 2772	2608	regsvr32.exe	68
PID 2608 wrote to memory of 2772	2608	regsvr32.exe	68
PID 2772 wrote to memory of 3868	2772	regsvr32.exe	69
PID 2772 wrote to memory of 3868	2772	regsvr32.exe	69
PID 2772 wrote to memory of 3868	2772	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\042cae5a9ecd942f35f652c5ed068bd1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\042cae5a9ecd942f35f652c5ed068bd1.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\042cae5a9ecd942f35f652c5ed068bd1.dll",DllRegisterServer
    3⤵
    PID:3868