266c7417b55739332384792b52e5adf1260920e56cd0a08e42dbfc40f969dca4

Analysis

Target
966dcb2dd4dd7bebc279e09137005349.dll
Size 629KB
Sample220128-jecqmshbdp
SHA256 266c7417b55739332384792b52e5adf1260920e56cd0a08e42dbfc40f969dca4
MD5 966dcb2dd4dd7bebc279e09137005349
SHA1 0d1554f7b21e23b5b159ac49cefb3bbb76c667ac
SHA512 c2ab826914e4ecc319cbe0b2522f57e369cbafe09d60034b741390c6fcbde56177c55ef9c093134b505c88ea87678b76d87e78e2f64f248ecf2e8329d33adf69
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 3596	3516	regsvr32.exe	68
PID 3516 wrote to memory of 3596	3516	regsvr32.exe	68
PID 3516 wrote to memory of 3596	3516	regsvr32.exe	68
PID 3596 wrote to memory of 4108	3596	regsvr32.exe	69
PID 3596 wrote to memory of 4108	3596	regsvr32.exe	69
PID 3596 wrote to memory of 4108	3596	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\966dcb2dd4dd7bebc279e09137005349.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\966dcb2dd4dd7bebc279e09137005349.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\966dcb2dd4dd7bebc279e09137005349.dll",DllRegisterServer
    3⤵
    PID:4108