64452408704c7f6c3150247e6614f9cf0f8bb74bd175bc4e07e6eed838f5b3f6

Analysis

Target
b114efa05a351ca7072f19417e68990d.dll
Size 629KB
Sample220128-k4gassachm
SHA256 64452408704c7f6c3150247e6614f9cf0f8bb74bd175bc4e07e6eed838f5b3f6
MD5 b114efa05a351ca7072f19417e68990d
SHA1 6119e88d3d1c0f2eb1ed00a0645ded1d50a99842
SHA512 a147b1f03e16994008860f456f95ccc94e39c1a07e4b44f29d9ac5ba7c0dfd70c320f428152bab067854b4770c7c0ee9d21f784d41c188a5d1c70868d459bbec
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2676	2428	regsvr32.exe	68
PID 2428 wrote to memory of 2676	2428	regsvr32.exe	68
PID 2428 wrote to memory of 2676	2428	regsvr32.exe	68
PID 2676 wrote to memory of 3532	2676	regsvr32.exe	69
PID 2676 wrote to memory of 3532	2676	regsvr32.exe	69
PID 2676 wrote to memory of 3532	2676	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b114efa05a351ca7072f19417e68990d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b114efa05a351ca7072f19417e68990d.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b114efa05a351ca7072f19417e68990d.dll",DllRegisterServer
    3⤵
    PID:3532