0366b2cf4a23dfabace5376c548a5535b6c8126e98762af36b09a56f2abf3b11

Analysis

Target
88d0948dd9f17e2fb7a6dc356877468f.dll
Size 496KB
Sample220127-b5wbnseab3
SHA256 0366b2cf4a23dfabace5376c548a5535b6c8126e98762af36b09a56f2abf3b11
MD5 88d0948dd9f17e2fb7a6dc356877468f
SHA1 db346719a109eef4e325d06e62bb707465dddc6c
SHA512 241889b7cc5821ab5e267f1609776029a25c91af4c1dd6523b7ba36a50b64bdb2c1c4552338c7aa7d6303af0288b5e759bbf5c41ca050bf98e617902912a0210
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 1996	3932	regsvr32.exe	69
PID 3932 wrote to memory of 1996	3932	regsvr32.exe	69
PID 3932 wrote to memory of 1996	3932	regsvr32.exe	69
PID 1996 wrote to memory of 1988	1996	regsvr32.exe	70
PID 1996 wrote to memory of 1988	1996	regsvr32.exe	70
PID 1996 wrote to memory of 1988	1996	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\88d0948dd9f17e2fb7a6dc356877468f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\88d0948dd9f17e2fb7a6dc356877468f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\88d0948dd9f17e2fb7a6dc356877468f.dll",DllRegisterServer
    3⤵
    PID:1988