1f8af3f6a12742c957f9d2ca23af244882efedbfa9398beaf90c003bd07147fe

Analysis

Target
QJ0hqh8OfSqL.dll
Size 784KB
Sample220126-ylek5shfcn
SHA256 1f8af3f6a12742c957f9d2ca23af244882efedbfa9398beaf90c003bd07147fe
MD5 1db84103db666ebf75ae318a076b6f73
SHA1 c601f997df2dea0463a88e509111d4b68920c30b
SHA512 06d769eddb0f0b9e4cbaaad21fee9ad13f23a42b3b321c1ee475abb36f6c82c72368f6861557693233bd77e477f92d87276c63a74d839842eb24524d487899e2
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2828	2772	regsvr32.exe	68
PID 2772 wrote to memory of 2828	2772	regsvr32.exe	68
PID 2772 wrote to memory of 2828	2772	regsvr32.exe	68
PID 2828 wrote to memory of 3968	2828	regsvr32.exe	69
PID 2828 wrote to memory of 3968	2828	regsvr32.exe	69
PID 2828 wrote to memory of 3968	2828	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\QJ0hqh8OfSqL.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\QJ0hqh8OfSqL.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\QJ0hqh8OfSqL.dll",DllRegisterServer
    3⤵
    PID:3968