f2b1089f184ee7ac63c057b7fe42e9d2032f5673caafbcdfd5786a4ff8afd0f0

Analysis

Target
3c62b3b7dcfb151b9f41f4eb38bfe7f9.dll
Size 496KB
Sample220127-ced55sebf4
SHA256 f2b1089f184ee7ac63c057b7fe42e9d2032f5673caafbcdfd5786a4ff8afd0f0
MD5 3c62b3b7dcfb151b9f41f4eb38bfe7f9
SHA1 3827e26e11a8c9923f4ab42c421398d832de25c9
SHA512 22831183edef98e24efda285acb67168ed04afb6b789813c1029284142dec6933c8e2ab26051413fd45d25e5fe77bf12122f6b229c1892a4ec383bd40e34a73a
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2116	2796	regsvr32.exe	69
PID 2796 wrote to memory of 2116	2796	regsvr32.exe	69
PID 2796 wrote to memory of 2116	2796	regsvr32.exe	69
PID 2116 wrote to memory of 3156	2116	regsvr32.exe	70
PID 2116 wrote to memory of 3156	2116	regsvr32.exe	70
PID 2116 wrote to memory of 3156	2116	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3c62b3b7dcfb151b9f41f4eb38bfe7f9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3c62b3b7dcfb151b9f41f4eb38bfe7f9.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\3c62b3b7dcfb151b9f41f4eb38bfe7f9.dll",DllRegisterServer
    3⤵
    PID:3156