383f80c794e72f8de283e75b3bbf047e94a67ccb11e7f0ce7bf18bf6d54626a8

Analysis

Target
04537f91e4b4d8b2fe9fb34c3e1fe4b4.dll
Size 784KB
Sample220126-wlb4xagff4
SHA256 383f80c794e72f8de283e75b3bbf047e94a67ccb11e7f0ce7bf18bf6d54626a8
MD5 04537f91e4b4d8b2fe9fb34c3e1fe4b4
SHA1 da0cf8c61c112d8b23fbf2f9109421958fea87c4
SHA512 d8c795cd69f6802634014bf4edc09c6a30e257d7117b67bdf125d6e1c01bb0dd11318e21e831263360223413c9ce22f54a6f02788b3e05bd74cf4be9d777b34b
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 852	552	regsvr32.exe	69
PID 552 wrote to memory of 852	552	regsvr32.exe	69
PID 552 wrote to memory of 852	552	regsvr32.exe	69
PID 852 wrote to memory of 1524	852	regsvr32.exe	70
PID 852 wrote to memory of 1524	852	regsvr32.exe	70
PID 852 wrote to memory of 1524	852	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\04537f91e4b4d8b2fe9fb34c3e1fe4b4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\04537f91e4b4d8b2fe9fb34c3e1fe4b4.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\04537f91e4b4d8b2fe9fb34c3e1fe4b4.dll",DllRegisterServer
    3⤵
    PID:1524