02c68d6e586e5865d36d9117984951546955747591f0a035014c05d9cb1ec79f

Analysis

Target
73ff2f76d708576576925501697a333c.dll
Size 784KB
Sample220126-vx5d6agcd5
SHA256 02c68d6e586e5865d36d9117984951546955747591f0a035014c05d9cb1ec79f
MD5 73ff2f76d708576576925501697a333c
SHA1 8166b591ef2ec02a4ba73df7ed5b3fe2170e33ce
SHA512 7403a98ef7c39c3b6bfb8bb8d0152bf2808e894778a1056004966b14c4ae63adc2bbfbad104b93a4f6ad2df4fba511aaa2b573f8d62e0e3f892f086f7b0164db
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2796	2760	regsvr32.exe	68
PID 2760 wrote to memory of 2796	2760	regsvr32.exe	68
PID 2760 wrote to memory of 2796	2760	regsvr32.exe	68
PID 2796 wrote to memory of 3976	2796	regsvr32.exe	69
PID 2796 wrote to memory of 3976	2796	regsvr32.exe	69
PID 2796 wrote to memory of 3976	2796	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\73ff2f76d708576576925501697a333c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\73ff2f76d708576576925501697a333c.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\73ff2f76d708576576925501697a333c.dll",DllRegisterServer
    3⤵
    PID:3976