bcf8a128ebd036fec4109d024107b191a66ad361c52626f16391ac4c9ca5b2f3

Analysis

Target
89837714ecdc7fc5c6377f5b71a86d8b.dll
Size 512KB
Sample220127-2stkescaap
SHA256 bcf8a128ebd036fec4109d024107b191a66ad361c52626f16391ac4c9ca5b2f3
MD5 89837714ecdc7fc5c6377f5b71a86d8b
SHA1 b970dabf3271db9da40038c6a37c0610a0a96a36
SHA512 2485dc922006248847d1c407c4120f5b784eb8a8c3c99b774183294d745edf0e1a16e2281a58025b01830d86a87a4b98a351c7bd0609548832b7f38af956c0a6
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 3024	2728	regsvr32.exe	68
PID 2728 wrote to memory of 3024	2728	regsvr32.exe	68
PID 2728 wrote to memory of 3024	2728	regsvr32.exe	68
PID 3024 wrote to memory of 916	3024	regsvr32.exe	69
PID 3024 wrote to memory of 916	3024	regsvr32.exe	69
PID 3024 wrote to memory of 916	3024	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\89837714ecdc7fc5c6377f5b71a86d8b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\89837714ecdc7fc5c6377f5b71a86d8b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\89837714ecdc7fc5c6377f5b71a86d8b.dll",DllRegisterServer
    3⤵
    PID:916