fb07be30ed623a7a2cb9ddf9c8cc7fcdf92249ec0ab706e33e86a3ea86d05597

Analysis

Target
4bc84b847c12ecf078dad4185396878c.dll
Size 496KB
Sample220127-bg88madcdn
SHA256 fb07be30ed623a7a2cb9ddf9c8cc7fcdf92249ec0ab706e33e86a3ea86d05597
MD5 4bc84b847c12ecf078dad4185396878c
SHA1 81926e69407116efe74bf672ad5a06f5499a3bca
SHA512 1ffce27e117e658c5aeef84560addad597a03ee01ae801b181cd587728bb4548b98798b91ee1458969da39e8d3a9525b9e4a46f94756d7a4a924d38cf41f44f2
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 3680	4144	regsvr32.exe	68
PID 4144 wrote to memory of 3680	4144	regsvr32.exe	68
PID 4144 wrote to memory of 3680	4144	regsvr32.exe	68
PID 3680 wrote to memory of 4140	3680	regsvr32.exe	69
PID 3680 wrote to memory of 4140	3680	regsvr32.exe	69
PID 3680 wrote to memory of 4140	3680	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4bc84b847c12ecf078dad4185396878c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4bc84b847c12ecf078dad4185396878c.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4bc84b847c12ecf078dad4185396878c.dll",DllRegisterServer
    3⤵
    PID:4140