a754524dcdccbf9c0bb29240d54d93c7375d727b987db1f0d39f5b1df4e11aad

Analysis

Target
1a9583bd6b75eddcf62b6c3712dfdb83.dll
Size 512KB
Sample220127-3p1d8scedj
SHA256 a754524dcdccbf9c0bb29240d54d93c7375d727b987db1f0d39f5b1df4e11aad
MD5 1a9583bd6b75eddcf62b6c3712dfdb83
SHA1 32640827d53d1319110a475ec1cd205cd4ba7420
SHA512 ce20dd913574fa5a5cfab8f3ae555555604b8bb9b4150ee5f03ada6deea9861fa3908dae8c2ba9166f74b7f012a775f738c1c9c6ec2cfba51b453f0a9f1229af
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 3972	3532	regsvr32.exe	69
PID 3532 wrote to memory of 3972	3532	regsvr32.exe	69
PID 3532 wrote to memory of 3972	3532	regsvr32.exe	69
PID 3972 wrote to memory of 2912	3972	regsvr32.exe	70
PID 3972 wrote to memory of 2912	3972	regsvr32.exe	70
PID 3972 wrote to memory of 2912	3972	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1a9583bd6b75eddcf62b6c3712dfdb83.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1a9583bd6b75eddcf62b6c3712dfdb83.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1a9583bd6b75eddcf62b6c3712dfdb83.dll",DllRegisterServer
    3⤵
    PID:2912