c92cbab9fb3996f6bd6a7b5d67040a355372faabde0b94481111fd2a33af6148

Analysis

Target
1aab808ec5e51bfd1cd89aeee47e2444.dll
Size 520KB
Sample220127-3p1d8scecr
SHA256 c92cbab9fb3996f6bd6a7b5d67040a355372faabde0b94481111fd2a33af6148
MD5 1aab808ec5e51bfd1cd89aeee47e2444
SHA1 78d47c5cd09c10af5cece383f281f84bc91fcab4
SHA512 e57d5967e41658b47cddb7452b6cbe4c9224817f40430985e94eec263d9cbcfcbced787c887f097371e3dc421cfaa9ff6525db646112f210cb5158cbcb804299
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 3576	1692	regsvr32.exe	68
PID 1692 wrote to memory of 3576	1692	regsvr32.exe	68
PID 1692 wrote to memory of 3576	1692	regsvr32.exe	68
PID 3576 wrote to memory of 1196	3576	regsvr32.exe	69
PID 3576 wrote to memory of 1196	3576	regsvr32.exe	69
PID 3576 wrote to memory of 1196	3576	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1aab808ec5e51bfd1cd89aeee47e2444.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1aab808ec5e51bfd1cd89aeee47e2444.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1aab808ec5e51bfd1cd89aeee47e2444.dll",DllRegisterServer
    3⤵
    PID:1196