851036ed7682d064cbe138f9fced2579f1729877a65aa979651f8afe0efefa8d

Analysis

Target
09931a47480b5e37865d9eb3566ed5af.dll
Size 496KB
Sample220127-bp4m4sdddm
SHA256 851036ed7682d064cbe138f9fced2579f1729877a65aa979651f8afe0efefa8d
MD5 09931a47480b5e37865d9eb3566ed5af
SHA1 edbb31a88ace1eb98ba0f8ded1d2f31af1f14e7e
SHA512 e7890e8893d7e2137e28c36f445d9f89c9ff3ad12feb66ab0a6d6d484316668ac35d12b05f10c6a38f1e03f0927917c35f70d8e44bb9d010357ff8c0c506e0c8
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2668	2460	regsvr32.exe	69
PID 2460 wrote to memory of 2668	2460	regsvr32.exe	69
PID 2460 wrote to memory of 2668	2460	regsvr32.exe	69
PID 2668 wrote to memory of 2512	2668	regsvr32.exe	70
PID 2668 wrote to memory of 2512	2668	regsvr32.exe	70
PID 2668 wrote to memory of 2512	2668	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\09931a47480b5e37865d9eb3566ed5af.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\09931a47480b5e37865d9eb3566ed5af.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\09931a47480b5e37865d9eb3566ed5af.dll",DllRegisterServer
    3⤵
    PID:2512