858fc75ee17bfd598aa70cc3b684f24822ca84dfa7f1358511a5b95abd5d54db

Analysis

Target
7ae00e30a3c5489afd854b688d5f085f.dll
Size 496KB
Sample220126-2asv6sbbgj
SHA256 858fc75ee17bfd598aa70cc3b684f24822ca84dfa7f1358511a5b95abd5d54db
MD5 7ae00e30a3c5489afd854b688d5f085f
SHA1 2685c5511cdc5e47e8f4bd672a49a4f5cfa71b1b
SHA512 27904c3fa6c6e15ca685cd1031355e0806425151a71f840ed1a69a3f4f75b6ea5afa88bee0162bfb7713effa8e10e8221ae908600e6b05fe6526abf7fdd38116
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 852	2848	regsvr32.exe	69
PID 2848 wrote to memory of 852	2848	regsvr32.exe	69
PID 2848 wrote to memory of 852	2848	regsvr32.exe	69
PID 852 wrote to memory of 1524	852	regsvr32.exe	70
PID 852 wrote to memory of 1524	852	regsvr32.exe	70
PID 852 wrote to memory of 1524	852	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7ae00e30a3c5489afd854b688d5f085f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7ae00e30a3c5489afd854b688d5f085f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\7ae00e30a3c5489afd854b688d5f085f.dll",DllRegisterServer
    3⤵
    PID:1524