11f032d17ba2f8d8a02e3ed412e8c5e96c15d45cc3daa92ee2d23ec33be52d1b

Analysis

Target
74f3c0ba669c5784d0456e438b94d28c.dll
Size 504KB
Sample220127-rezjeadhfm
SHA256 11f032d17ba2f8d8a02e3ed412e8c5e96c15d45cc3daa92ee2d23ec33be52d1b
MD5 74f3c0ba669c5784d0456e438b94d28c
SHA1 f1730a1ff2464cdc636ad8b89d5c82b84d078524
SHA512 3e830ee3859bcb1868496e4e0b6efb85959a26d830b0e82326ada6c6685db394ade3cd53f0bb3e2fe188dff93eae710f73d53cffda6433a979512ed1bdb931e6
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 2772	3580	regsvr32.exe	69
PID 3580 wrote to memory of 2772	3580	regsvr32.exe	69
PID 3580 wrote to memory of 2772	3580	regsvr32.exe	69
PID 2772 wrote to memory of 864	2772	regsvr32.exe	70
PID 2772 wrote to memory of 864	2772	regsvr32.exe	70
PID 2772 wrote to memory of 864	2772	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\74f3c0ba669c5784d0456e438b94d28c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\74f3c0ba669c5784d0456e438b94d28c.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\74f3c0ba669c5784d0456e438b94d28c.dll",DllRegisterServer
    3⤵
    PID:864