bce024fb116f7acb57b943f5c3d1c5baa86d3e67e2069b327bedc86d30fd1bbb

Analysis

Target
HJhnpnmOYMa.dll
Size 784KB
Sample220126-qlnj2sdban
SHA256 bce024fb116f7acb57b943f5c3d1c5baa86d3e67e2069b327bedc86d30fd1bbb
MD5 ec7a703beb7389740e027011a96f6ab8
SHA1 2abce7918eccb99dfbcd3410b88b5b05b8b3a175
SHA512 7c6b7fef639bbc48a0406c4fdc748f146f17bc3d60d9f77fbe1a0668230cfa21b4d84e69cab4a29372e75b1dfd071ecb1d82cc912cdc62b828eb8c409d5c562d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 3620	3336	regsvr32.exe	68
PID 3336 wrote to memory of 3620	3336	regsvr32.exe	68
PID 3336 wrote to memory of 3620	3336	regsvr32.exe	68
PID 3620 wrote to memory of 3356	3620	regsvr32.exe	69
PID 3620 wrote to memory of 3356	3620	regsvr32.exe	69
PID 3620 wrote to memory of 3356	3620	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\HJhnpnmOYMa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\HJhnpnmOYMa.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\HJhnpnmOYMa.dll",DllRegisterServer
    3⤵
    PID:3356