41adf4c7cee10920b82f24fff7bb9c6d3fed6d2d63c42589dd9e00ad3d903069

Analysis

Target
d4e77f3a23a6ff0a928054692f9b079c.dll
Size 520KB
Sample220127-21panscagq
SHA256 41adf4c7cee10920b82f24fff7bb9c6d3fed6d2d63c42589dd9e00ad3d903069
MD5 d4e77f3a23a6ff0a928054692f9b079c
SHA1 836534ac5982cfca5605543ceff18b7c82b7766e
SHA512 fef948b09cc5f670f3bda4db0b49dacdfc71ab02c98e4c54426780799231cf52cbb415f33b76408c9810e5c2b5202a050111d2189920e10bcc5601aff4e35558
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 3796	2740	regsvr32.exe	69
PID 2740 wrote to memory of 3796	2740	regsvr32.exe	69
PID 2740 wrote to memory of 3796	2740	regsvr32.exe	69
PID 3796 wrote to memory of 2732	3796	regsvr32.exe	70
PID 3796 wrote to memory of 2732	3796	regsvr32.exe	70
PID 3796 wrote to memory of 2732	3796	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d4e77f3a23a6ff0a928054692f9b079c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d4e77f3a23a6ff0a928054692f9b079c.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\d4e77f3a23a6ff0a928054692f9b079c.dll",DllRegisterServer
    3⤵
    PID:2732