1052142d7f7ffcaabfaf31100eef7e0e88d51ff89aec0463ffd6ac98f83f166c

Analysis

Target
c0253a7e6d6e2f9224fcdf611ec3e30b.dll
Size 504KB
Sample220127-b5v1xaeab2
SHA256 1052142d7f7ffcaabfaf31100eef7e0e88d51ff89aec0463ffd6ac98f83f166c
MD5 c0253a7e6d6e2f9224fcdf611ec3e30b
SHA1 c792cdfe28a90e5d5237d1f8b01dfac7c25bcb0c
SHA512 5ffe902fcdca8d89a0149ba549d4b86a4699582737367a584459a125b820637029049f5bb7fb7ea5c17f56f380b6f8e34d770df9e97e9f15ec443ff3f2dbe47c
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2648	2584	regsvr32.exe	68
PID 2584 wrote to memory of 2648	2584	regsvr32.exe	68
PID 2584 wrote to memory of 2648	2584	regsvr32.exe	68
PID 2648 wrote to memory of 1008	2648	regsvr32.exe	69
PID 2648 wrote to memory of 1008	2648	regsvr32.exe	69
PID 2648 wrote to memory of 1008	2648	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c0253a7e6d6e2f9224fcdf611ec3e30b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c0253a7e6d6e2f9224fcdf611ec3e30b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\c0253a7e6d6e2f9224fcdf611ec3e30b.dll",DllRegisterServer
    3⤵
    PID:1008