df76a0c3eea89048330dcca2bb84ef54cae71713b4910e5378fe7923e07bdadd

Analysis

Target
8b28d69dd8498d5b322351fdb235d77a.dll
Size 496KB
Sample220127-ajcf1achg6
SHA256 df76a0c3eea89048330dcca2bb84ef54cae71713b4910e5378fe7923e07bdadd
MD5 8b28d69dd8498d5b322351fdb235d77a
SHA1 bcccb11a6819ce58d4ab3b54c207ffa3a418bd27
SHA512 6c3bf74b26d3b8bffcf362e34c0b996766358e8bad1586b107c9c39f440a7ef0a148c401c774138c049328bcb125579e5be3edf937b0a91a6e02afd8a4cc15b3
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 2400	3156	regsvr32.exe	69
PID 3156 wrote to memory of 2400	3156	regsvr32.exe	69
PID 3156 wrote to memory of 2400	3156	regsvr32.exe	69
PID 2400 wrote to memory of 2492	2400	regsvr32.exe	70
PID 2400 wrote to memory of 2492	2400	regsvr32.exe	70
PID 2400 wrote to memory of 2492	2400	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8b28d69dd8498d5b322351fdb235d77a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8b28d69dd8498d5b322351fdb235d77a.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8b28d69dd8498d5b322351fdb235d77a.dll",DllRegisterServer
    3⤵
    PID:2492