296e2b5642a0dc4613c8e30c7ff1fddbb6993b998a385ccab320cefa1dd67230

Analysis

Target
b34fc260ead1a09f0cf0a1dbd4976722.dll
Size 629KB
Sample220128-kd64jaade5
SHA256 296e2b5642a0dc4613c8e30c7ff1fddbb6993b998a385ccab320cefa1dd67230
MD5 b34fc260ead1a09f0cf0a1dbd4976722
SHA1 eec89c043cbbbd1a923e02a21af0a1c61129f298
SHA512 30d1637fcc2ee27dce28eb486ee541235a3ba83fe7c98b122d150e3a5c5963b8dfc6fb40f6c573a8513770bb7308697e32634abf7da6ebaace16811896931304
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 3788	3708	regsvr32.exe	69
PID 3708 wrote to memory of 3788	3708	regsvr32.exe	69
PID 3708 wrote to memory of 3788	3708	regsvr32.exe	69
PID 3788 wrote to memory of 1052	3788	regsvr32.exe	70
PID 3788 wrote to memory of 1052	3788	regsvr32.exe	70
PID 3788 wrote to memory of 1052	3788	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b34fc260ead1a09f0cf0a1dbd4976722.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b34fc260ead1a09f0cf0a1dbd4976722.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\b34fc260ead1a09f0cf0a1dbd4976722.dll",DllRegisterServer
    3⤵
    PID:1052