c67966f9edff33ac3278bfee8f17758ce75b6982401a5ab5df22e6ad91a1e9a6

Analysis

Target
ae6e853e9b3c58466a66489318553347.dll
Size 784KB
Sample220126-mz5tpscacl
SHA256 c67966f9edff33ac3278bfee8f17758ce75b6982401a5ab5df22e6ad91a1e9a6
MD5 ae6e853e9b3c58466a66489318553347
SHA1 3bf0b6a14e544a284803a99cfca19fb1a86a9780
SHA512 1ce0bdffba49e3a797a616d00cd7a507715ce9c1a2594082291d53d1c69d7631e37e0e790d49a5172549904acd4835d226e7eaac27a51e369c64e517ee34a5bc
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 3048	2660	regsvr32.exe	68
PID 2660 wrote to memory of 3048	2660	regsvr32.exe	68
PID 2660 wrote to memory of 3048	2660	regsvr32.exe	68
PID 3048 wrote to memory of 4084	3048	regsvr32.exe	69
PID 3048 wrote to memory of 4084	3048	regsvr32.exe	69
PID 3048 wrote to memory of 4084	3048	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ae6e853e9b3c58466a66489318553347.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ae6e853e9b3c58466a66489318553347.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ae6e853e9b3c58466a66489318553347.dll",DllRegisterServer
    3⤵
    PID:4084