7f959b5a3df074e250c8ea5b32e9cf927e5df2a83c820a2fcb84d19a4a46df25

Analysis

Target
dc1228f3f065f8ed869d371383d8dd61.dll
Size 512KB
Sample220127-2ljrmscee3
SHA256 7f959b5a3df074e250c8ea5b32e9cf927e5df2a83c820a2fcb84d19a4a46df25
MD5 dc1228f3f065f8ed869d371383d8dd61
SHA1 9d89bc97f6c9274f8a9ea78fa06fa991555ea3f9
SHA512 f4a2580f0acb9a78c70b4214c5fe42656f96af048644f6b7905cf0fa65ca70360cd069c27d77e9aa79c84638ac9437cc66c9a39ab0bce6ba0ab465c358f1e4e3
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3112	2820	regsvr32.exe	69
PID 2820 wrote to memory of 3112	2820	regsvr32.exe	69
PID 2820 wrote to memory of 3112	2820	regsvr32.exe	69
PID 3112 wrote to memory of 2244	3112	regsvr32.exe	70
PID 3112 wrote to memory of 2244	3112	regsvr32.exe	70
PID 3112 wrote to memory of 2244	3112	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dc1228f3f065f8ed869d371383d8dd61.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dc1228f3f065f8ed869d371383d8dd61.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\dc1228f3f065f8ed869d371383d8dd61.dll",DllRegisterServer
    3⤵
    PID:2244