cdb7487cd4094876e9a78de1b7fcc1149d5daa3971fe030d273c2e535d145498

Analysis

Target
http___pigij.com_wp-admin_MVW5_Wed_Jan_26_10_30_03_PM_CST_2022.dll
Size 504KB
Sample220127-e8b9raffap
SHA256 cdb7487cd4094876e9a78de1b7fcc1149d5daa3971fe030d273c2e535d145498
MD5 cb2f335cd4ef45c5911aefb845c017f4
SHA1 e7b1dac4ef472bd7c0f441545f3dcc02f8c6f9e1
SHA512 ae1e7879cc2c35deef0d26664f064bc0f7cbdbf25014a008704c6129a9e3465adf0be60d46c02db08a10d319c70fe54303c31e453573573efb22dc74bb8cdee0
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3796	3208	regsvr32.exe	69
PID 3208 wrote to memory of 3796	3208	regsvr32.exe	69
PID 3208 wrote to memory of 3796	3208	regsvr32.exe	69
PID 3796 wrote to memory of 4036	3796	regsvr32.exe	70
PID 3796 wrote to memory of 4036	3796	regsvr32.exe	70
PID 3796 wrote to memory of 4036	3796	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\http___pigij.com_wp-admin_MVW5_Wed_Jan_26_10_30_03_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\http___pigij.com_wp-admin_MVW5_Wed_Jan_26_10_30_03_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\http___pigij.com_wp-admin_MVW5_Wed_Jan_26_10_30_03_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:4036