47afab679cf9bdac23b3ca6917530668fbbf8f448e853faf3d3d52d2f4b1024f

Analysis

Target
334fbfd9e06c3321b1ec4b748b7eb772.dll
Size 504KB
Sample220127-sagngafad8
SHA256 47afab679cf9bdac23b3ca6917530668fbbf8f448e853faf3d3d52d2f4b1024f
MD5 334fbfd9e06c3321b1ec4b748b7eb772
SHA1 afe87af44d05f81e5eaf220dec322d7c0881dec3
SHA512 3591dcab69d36dc49735098443dc8dcdcc97c8c7882b8826ec76eee9e7c1199f3de0a588bc52f9a85a77d83f19841033ccc5ef74d17f8689a6066795fdc90d7e
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 524	2760	regsvr32.exe	69
PID 2760 wrote to memory of 524	2760	regsvr32.exe	69
PID 2760 wrote to memory of 524	2760	regsvr32.exe	69
PID 524 wrote to memory of 2632	524	regsvr32.exe	70
PID 524 wrote to memory of 2632	524	regsvr32.exe	70
PID 524 wrote to memory of 2632	524	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\334fbfd9e06c3321b1ec4b748b7eb772.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\334fbfd9e06c3321b1ec4b748b7eb772.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:524
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\334fbfd9e06c3321b1ec4b748b7eb772.dll",DllRegisterServer
    3⤵
    PID:2632