425eb4e287d6d088ac70f0a294bb9fafec14242bcffc0c1659d36e7cd37059c7

Analysis

Target
c8283d4f26bf97744c3a4ea24d88b4c6.dll
Size 520KB
Sample220127-3p1d8sdbc7
SHA256 425eb4e287d6d088ac70f0a294bb9fafec14242bcffc0c1659d36e7cd37059c7
MD5 c8283d4f26bf97744c3a4ea24d88b4c6
SHA1 f78807d286f688b7994e3d362e8aaa71d0dc274c
SHA512 1ce654e53c24c3817881f15449ce2b9a9a910cfe03a39d47514b389390eceffbd70388f3dd297ba457c84a80e45579f70c53383af07713e002dba7c82b8415b7
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 1320	988	regsvr32.exe	68
PID 988 wrote to memory of 1320	988	regsvr32.exe	68
PID 988 wrote to memory of 1320	988	regsvr32.exe	68
PID 1320 wrote to memory of 772	1320	regsvr32.exe	69
PID 1320 wrote to memory of 772	1320	regsvr32.exe	69
PID 1320 wrote to memory of 772	1320	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c8283d4f26bf97744c3a4ea24d88b4c6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c8283d4f26bf97744c3a4ea24d88b4c6.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c8283d4f26bf97744c3a4ea24d88b4c6.dll",DllRegisterServer
    3⤵
    PID:772