6777e8bb18577f7d1798f6d7f4640f81a1968f5ac3ce410ef65f37b94efb3f31

Analysis

Target
17e4107ec67a0241342344bba08a850b.dll
Size 512KB
Sample220127-ss397aehbm
SHA256 6777e8bb18577f7d1798f6d7f4640f81a1968f5ac3ce410ef65f37b94efb3f31
MD5 17e4107ec67a0241342344bba08a850b
SHA1 91f3b67b3946b96d50ec17f946387213f333a275
SHA512 9f60217c1f5e2a9cfa7a8bada5a885c9a380205923710ecdbca4f490dfd17b78be568ea0d693fe9ed144b68f07a556dacb7e1bc53bcfe7f43185f410d1aee0de
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 424	2424	regsvr32.exe	69
PID 2424 wrote to memory of 424	2424	regsvr32.exe	69
PID 2424 wrote to memory of 424	2424	regsvr32.exe	69
PID 424 wrote to memory of 2300	424	regsvr32.exe	70
PID 424 wrote to memory of 2300	424	regsvr32.exe	70
PID 424 wrote to memory of 2300	424	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\17e4107ec67a0241342344bba08a850b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\17e4107ec67a0241342344bba08a850b.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:424
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\17e4107ec67a0241342344bba08a850b.dll",DllRegisterServer
    3⤵
    PID:2300