06e4252365b76a623df5683f80da96633747bb23ab82da340c6664ae991fa6fb

Analysis

Target
62271ac3fd1e65788baada5f36fbd79b.dll
Size 784KB
Sample220126-vnkcmafegp
SHA256 06e4252365b76a623df5683f80da96633747bb23ab82da340c6664ae991fa6fb
MD5 62271ac3fd1e65788baada5f36fbd79b
SHA1 b94e4da86bd5f1174989d6a6280f89339cfbf0c9
SHA512 26b28604104496b49c9b96bb4de339593104fb8ae84e2dedc36f6668640740ced1a68ee303dae64491bf4d6e210c863ddf2506d33373611382fdd458c04e34ef
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 3668	3600	regsvr32.exe	68
PID 3600 wrote to memory of 3668	3600	regsvr32.exe	68
PID 3600 wrote to memory of 3668	3600	regsvr32.exe	68
PID 3668 wrote to memory of 64	3668	regsvr32.exe	69
PID 3668 wrote to memory of 64	3668	regsvr32.exe	69
PID 3668 wrote to memory of 64	3668	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\62271ac3fd1e65788baada5f36fbd79b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\62271ac3fd1e65788baada5f36fbd79b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\62271ac3fd1e65788baada5f36fbd79b.dll",DllRegisterServer
    3⤵
    PID:64