3f2e5178eb1546e6208867d59eaa32b585907a896e97844a9ec0747bc074df0a

Analysis

Target
fa18a8b9dfc7cfa9c7ee8abc3b9ad84f.dll
Size 504KB
Sample220127-ag9cyscfaj
SHA256 3f2e5178eb1546e6208867d59eaa32b585907a896e97844a9ec0747bc074df0a
MD5 fa18a8b9dfc7cfa9c7ee8abc3b9ad84f
SHA1 5b6ab615d7d508adb2b8fd50387968cd0f6070fb
SHA512 b85c93b84eb976924b9c2cd5388ae596edae77fe5966205fb5ba92fcfddeac79e9977ac6ac2a619dffff7f9d8fcdad561c8c5ea25d963f1d86c41b40210d7d4a
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 3776	3440	regsvr32.exe	68
PID 3440 wrote to memory of 3776	3440	regsvr32.exe	68
PID 3440 wrote to memory of 3776	3440	regsvr32.exe	68
PID 3776 wrote to memory of 3676	3776	regsvr32.exe	69
PID 3776 wrote to memory of 3676	3776	regsvr32.exe	69
PID 3776 wrote to memory of 3676	3776	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fa18a8b9dfc7cfa9c7ee8abc3b9ad84f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fa18a8b9dfc7cfa9c7ee8abc3b9ad84f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\fa18a8b9dfc7cfa9c7ee8abc3b9ad84f.dll",DllRegisterServer
    3⤵
    PID:3676