61bbc1907b1207aa2de868034febbce3870d79206401e43203e8ceff6e18e0e2

Analysis

Target
33dc99c26ebac440e75b3f9119aef850.dll
Size 784KB
Sample220126-wtqx2aghc7
SHA256 61bbc1907b1207aa2de868034febbce3870d79206401e43203e8ceff6e18e0e2
MD5 33dc99c26ebac440e75b3f9119aef850
SHA1 60592ce25849695a8baac8e762fccb9b2a177cd3
SHA512 7bd3b4db3368a54b15d634f71317b6c3e0c30e1a746538a73d80d9b527a31c830a523be66953cc3cdbbbf1076c0447e931e8490e638b5b1332a46bae3c8e9ef4
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 3488	2672	regsvr32.exe	68
PID 2672 wrote to memory of 3488	2672	regsvr32.exe	68
PID 2672 wrote to memory of 3488	2672	regsvr32.exe	68
PID 3488 wrote to memory of 2708	3488	regsvr32.exe	69
PID 3488 wrote to memory of 2708	3488	regsvr32.exe	69
PID 3488 wrote to memory of 2708	3488	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\33dc99c26ebac440e75b3f9119aef850.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\33dc99c26ebac440e75b3f9119aef850.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\33dc99c26ebac440e75b3f9119aef850.dll",DllRegisterServer
    3⤵
    PID:2708