f1309f6de8e732b79c6a86879fafea35bc9430d892f22af3d6d35a4ca84ae802

Analysis

Target
aa9bfc5ba92c7ff5c27823e0862d9002.dll
Size 784KB
Sample220126-wlb4xagfe9
SHA256 f1309f6de8e732b79c6a86879fafea35bc9430d892f22af3d6d35a4ca84ae802
MD5 aa9bfc5ba92c7ff5c27823e0862d9002
SHA1 8e278387e7c11362cec8df2f8379dc2f8aa73997
SHA512 a5a675af44979de5c55fc6b046375040e8093c2e341551b45552e7e87d556c5a768eee352c8df9cc5d9f9692a7bc60d52adc021db1d88bcd045f5a6a0e5798f7
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 3100	3240	regsvr32.exe	69
PID 3240 wrote to memory of 3100	3240	regsvr32.exe	69
PID 3240 wrote to memory of 3100	3240	regsvr32.exe	69
PID 3100 wrote to memory of 808	3100	regsvr32.exe	70
PID 3100 wrote to memory of 808	3100	regsvr32.exe	70
PID 3100 wrote to memory of 808	3100	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aa9bfc5ba92c7ff5c27823e0862d9002.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\aa9bfc5ba92c7ff5c27823e0862d9002.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\aa9bfc5ba92c7ff5c27823e0862d9002.dll",DllRegisterServer
    3⤵
    PID:808