374dc120d99d608b6779f312cf60e13e340c53edffc804e80041d4ae803c7fc6

Analysis

Target
00323a3734df55ee89a09e7ce2238e7e.dll
Size 784KB
Sample220126-l8h6macah4
SHA256 374dc120d99d608b6779f312cf60e13e340c53edffc804e80041d4ae803c7fc6
MD5 00323a3734df55ee89a09e7ce2238e7e
SHA1 8e3761d43634a33dfe6240eb08e4a0f8f6b7a379
SHA512 2c319d6fc41d0f36ab8a1988a492d02d89535b8651c69b65d8f531a0d0a89754468b9fb93c53129379af03fe78fd719f52d941e388011f40983ef67a8d4c350b
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 4084	2564	regsvr32.exe	69
PID 2564 wrote to memory of 4084	2564	regsvr32.exe	69
PID 2564 wrote to memory of 4084	2564	regsvr32.exe	69
PID 4084 wrote to memory of 3724	4084	regsvr32.exe	70
PID 4084 wrote to memory of 3724	4084	regsvr32.exe	70
PID 4084 wrote to memory of 3724	4084	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\00323a3734df55ee89a09e7ce2238e7e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\00323a3734df55ee89a09e7ce2238e7e.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\00323a3734df55ee89a09e7ce2238e7e.dll",DllRegisterServer
    3⤵
    PID:3724