6593e6c209c4facce5302152da0c913abb480bedb809f378ca04287f78652eb0

Analysis

Target
https___algzor.com_wp-includes_ghFXVrGLEh_Thu_Jan_27_11_18_33_AM_CST_2022.dll
Size 520KB
Sample220127-vx5pxshaa7
SHA256 6593e6c209c4facce5302152da0c913abb480bedb809f378ca04287f78652eb0
MD5 d9b04e4c65a106d016b9113b8978ed78
SHA1 b57d9fcdadc7a46ed03e61ca1b3df1d0bfb5cb74
SHA512 8b8bbcb4a0516f4f0a55e8de4b942c8ca96067935a403c85755a02406628961962199a97f44dfb77842c4bdc313931b81a3c308a459c525da7ef7841b58c4374
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2752	2720	regsvr32.exe	69
PID 2720 wrote to memory of 2752	2720	regsvr32.exe	69
PID 2720 wrote to memory of 2752	2720	regsvr32.exe	69
PID 2752 wrote to memory of 2108	2752	regsvr32.exe	70
PID 2752 wrote to memory of 2108	2752	regsvr32.exe	70
PID 2752 wrote to memory of 2108	2752	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\https___algzor.com_wp-includes_ghFXVrGLEh_Thu_Jan_27_11_18_33_AM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\https___algzor.com_wp-includes_ghFXVrGLEh_Thu_Jan_27_11_18_33_AM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\https___algzor.com_wp-includes_ghFXVrGLEh_Thu_Jan_27_11_18_33_AM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:2108