115dcdd9207900e1fdaa0e5089ea029596d3da345e34ebfc5fbdaa6dd78e57dd

Analysis

Target
BoDSs7MrmhytYnFDSBA.dll
Size 784KB
Sample220126-naweeacbbm
SHA256 115dcdd9207900e1fdaa0e5089ea029596d3da345e34ebfc5fbdaa6dd78e57dd
MD5 1103116cbb4ba9d90e44aa2612916fe4
SHA1 1c0a37e9441782a3fe18143a814821d9d4055354
SHA512 85864ce5a0d6f4f741280faa7648295581ebe5bf29a5bae1644ac74ca18298243f36ab3c0a3c3b3c263fe30c81b83bb0fb583c834422ca1e613b5f786ef785e1
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 3460	2656	regsvr32.exe	69
PID 2656 wrote to memory of 3460	2656	regsvr32.exe	69
PID 2656 wrote to memory of 3460	2656	regsvr32.exe	69
PID 3460 wrote to memory of 3116	3460	regsvr32.exe	70
PID 3460 wrote to memory of 3116	3460	regsvr32.exe	70
PID 3460 wrote to memory of 3116	3460	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\BoDSs7MrmhytYnFDSBA.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\BoDSs7MrmhytYnFDSBA.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\BoDSs7MrmhytYnFDSBA.dll",DllRegisterServer
    3⤵
    PID:3116