b206fdee1cf8e815c833bc501d89849bec91057efe2807a2edb89aa7d37f584f

Analysis

Target
xv78rN4JqGp8p2f.dll
Size 504KB
Sample220127-l1py7sbad7
SHA256 b206fdee1cf8e815c833bc501d89849bec91057efe2807a2edb89aa7d37f584f
MD5 a0fa2640dffd016771000562fd770798
SHA1 c3c898e243b9ba8f95032019cadb124493d8d5c2
SHA512 bc95cac7087f9799a281f26a45fc0e40f1f14c1d94a207203225e7c71844a2c9af88c3acc1d166237b647e1e062075064168013acf1eeec9121b4dfa6d89f88d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 3064	3760	regsvr32.exe	68
PID 3760 wrote to memory of 3064	3760	regsvr32.exe	68
PID 3760 wrote to memory of 3064	3760	regsvr32.exe	68
PID 3064 wrote to memory of 524	3064	regsvr32.exe	69
PID 3064 wrote to memory of 524	3064	regsvr32.exe	69
PID 3064 wrote to memory of 524	3064	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\xv78rN4JqGp8p2f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\xv78rN4JqGp8p2f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\xv78rN4JqGp8p2f.dll",DllRegisterServer
    3⤵
    PID:524