0556ef8fe8499a20c0b5dd9b0c35940d3e34b4e17bcf88b245f70297a165a911

Analysis

Target
http___strawberry.kids-singer.net_assets_c_WAdvNT84Dmu_Wed_Jan_26_10_27_35_PM_CST_2022.dll
Size 784KB
Sample220127-e8ckhsffbk
SHA256 0556ef8fe8499a20c0b5dd9b0c35940d3e34b4e17bcf88b245f70297a165a911
MD5 00d9be07527d9fcab7812ff67556e359
SHA1 5d3ec73ea02dee17e270afca78886d7bdc6160b3
SHA512 70fe54386a1988a5840932cd53ce5565421454efaa736b925f8852f24baa79c4739ff5660b3af18e13054cf03c1f75a34389a7692c7e3ea8a92e93e09d211d20
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2428	2384	regsvr32.exe	68
PID 2384 wrote to memory of 2428	2384	regsvr32.exe	68
PID 2384 wrote to memory of 2428	2384	regsvr32.exe	68
PID 2428 wrote to memory of 3776	2428	regsvr32.exe	69
PID 2428 wrote to memory of 3776	2428	regsvr32.exe	69
PID 2428 wrote to memory of 3776	2428	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\http___strawberry.kids-singer.net_assets_c_WAdvNT84Dmu_Wed_Jan_26_10_27_35_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\http___strawberry.kids-singer.net_assets_c_WAdvNT84Dmu_Wed_Jan_26_10_27_35_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\http___strawberry.kids-singer.net_assets_c_WAdvNT84Dmu_Wed_Jan_26_10_27_35_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:3776