38b2ca3de4b489c128e09ead97c43da5eeb6c9c39def21c913775abf7b8d8fd4

Analysis

Target
f3e06c9c218898e05d316ce655227d04.dll
Size 638KB
Sample220128-k4gassachl
SHA256 38b2ca3de4b489c128e09ead97c43da5eeb6c9c39def21c913775abf7b8d8fd4
MD5 f3e06c9c218898e05d316ce655227d04
SHA1 3ba7ae7ac99bf0b13ceef15c64b974265b1bcdc9
SHA512 906a188e67f6c471c77d24463da54d563441e70d418de9f92925574942e5e8ff98de2c10a8e4ee2c8b0fd797714c16ec33884070cb789061c6ef2fbf2997d988
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 3584	3704	regsvr32.exe	69
PID 3704 wrote to memory of 3584	3704	regsvr32.exe	69
PID 3704 wrote to memory of 3584	3704	regsvr32.exe	69
PID 3584 wrote to memory of 852	3584	regsvr32.exe	70
PID 3584 wrote to memory of 852	3584	regsvr32.exe	70
PID 3584 wrote to memory of 852	3584	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f3e06c9c218898e05d316ce655227d04.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f3e06c9c218898e05d316ce655227d04.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f3e06c9c218898e05d316ce655227d04.dll",DllRegisterServer
    3⤵
    PID:852