60ec6c4dc4216a9e5e58937ee91fecb9d8286ca471dfb0a30e4a90d77bc8d39b

Analysis

Target
e7712e0cea86f9c80b7e65471e01e901.dll
Size 638KB
Sample220128-kd64jaade7
SHA256 60ec6c4dc4216a9e5e58937ee91fecb9d8286ca471dfb0a30e4a90d77bc8d39b
MD5 e7712e0cea86f9c80b7e65471e01e901
SHA1 fb64995ca94783bfe893295cebab60909a0a3828
SHA512 c94ee6e7235addd9146593f6af422d23fdc92dc113880ef0638096f91cd7912b6333ec767946b1d3c2a57f00d108ea2673569f5fe460ef2f075b49c38eb9a2b8
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 680	2672	regsvr32.exe	69
PID 2672 wrote to memory of 680	2672	regsvr32.exe	69
PID 2672 wrote to memory of 680	2672	regsvr32.exe	69
PID 680 wrote to memory of 2804	680	regsvr32.exe	70
PID 680 wrote to memory of 2804	680	regsvr32.exe	70
PID 680 wrote to memory of 2804	680	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e7712e0cea86f9c80b7e65471e01e901.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e7712e0cea86f9c80b7e65471e01e901.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\e7712e0cea86f9c80b7e65471e01e901.dll",DllRegisterServer
    3⤵
    PID:2804