9269532b08f4bf69dfeb874c4b7fa2d689e055cc31548e1afd2962e96960a482

Analysis

Target
1c4e5d2e376eb40614a7f9bdce19cd8a.dll
Size 520KB
Sample220127-3p1d8sdbc5
SHA256 9269532b08f4bf69dfeb874c4b7fa2d689e055cc31548e1afd2962e96960a482
MD5 1c4e5d2e376eb40614a7f9bdce19cd8a
SHA1 dbd2d60f0b03c56819864a4bc5d227917a6fa12f
SHA512 8e7f851386a8c3d0606d19496ad53bdddb6327f0bebc1a25e83ca572fcb71184a8bf7d37a1dc008575d8bf4fa63bef2e0074749527864ff5aaf68eb8ea18be5f
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 2868	4000	regsvr32.exe	69
PID 4000 wrote to memory of 2868	4000	regsvr32.exe	69
PID 4000 wrote to memory of 2868	4000	regsvr32.exe	69
PID 2868 wrote to memory of 3888	2868	regsvr32.exe	70
PID 2868 wrote to memory of 3888	2868	regsvr32.exe	70
PID 2868 wrote to memory of 3888	2868	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1c4e5d2e376eb40614a7f9bdce19cd8a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1c4e5d2e376eb40614a7f9bdce19cd8a.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\1c4e5d2e376eb40614a7f9bdce19cd8a.dll",DllRegisterServer
    3⤵
    PID:3888