eebe2d2b5ea65d0698fab693d9d6b948a7927fa54c6014bfc826d1f74c80372c

Analysis

Target
33bg5kflUU.dll
Size 784KB
Sample220126-qk4vmsdec8
SHA256 eebe2d2b5ea65d0698fab693d9d6b948a7927fa54c6014bfc826d1f74c80372c
MD5 23b88afc14265d61810b88bbf65bcfbb
SHA1 1ddd841f12bb2226856347ed430024cf1976fb42
SHA512 63787bdea09eca428ebd037318db1a999a07033707351ff5a9b26217221eeda8ca5d42a9695406072b5ed4f018b61eb28e4498d9d59859af38f59f7ce1769418
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2656	2652	regsvr32.exe	68
PID 2652 wrote to memory of 2656	2652	regsvr32.exe	68
PID 2652 wrote to memory of 2656	2652	regsvr32.exe	68
PID 2656 wrote to memory of 3812	2656	regsvr32.exe	69
PID 2656 wrote to memory of 3812	2656	regsvr32.exe	69
PID 2656 wrote to memory of 3812	2656	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\33bg5kflUU.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\33bg5kflUU.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\33bg5kflUU.dll",DllRegisterServer
    3⤵
    PID:3812