b0d8f64fa974277bb2b0c80db6f9dff7c3be2610f5ed466ec2e0d640c938c2de

Analysis

Target
3f4bc23b93391cda505d1781e113dcee.dll
Size 784KB
Sample220126-v56xysfhep
SHA256 b0d8f64fa974277bb2b0c80db6f9dff7c3be2610f5ed466ec2e0d640c938c2de
MD5 3f4bc23b93391cda505d1781e113dcee
SHA1 52db2bbe855ca418302841b454eb2ddc5e1a9540
SHA512 9b4ebbd1df0787c14e04f5284d85fcf1a08d027a73c33b0f3c09fea369d9368d24ea00312d2d04a991eef16041fa5d97ee86e524aaa9190f9ee0af3192d70cf6
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 3296	2620	regsvr32.exe	68
PID 2620 wrote to memory of 3296	2620	regsvr32.exe	68
PID 2620 wrote to memory of 3296	2620	regsvr32.exe	68
PID 3296 wrote to memory of 3712	3296	regsvr32.exe	69
PID 3296 wrote to memory of 3712	3296	regsvr32.exe	69
PID 3296 wrote to memory of 3712	3296	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3f4bc23b93391cda505d1781e113dcee.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3f4bc23b93391cda505d1781e113dcee.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3f4bc23b93391cda505d1781e113dcee.dll",DllRegisterServer
    3⤵
    PID:3712