7a429c94fc0a1ba5edac092acb404f1f183e4f87e051284a10e6ad6214abfd9f

Analysis

Target
cba8715c81eeb7b4c76db27789b97266.dll
Size 629KB
Sample220128-kmkxnaafa2
SHA256 7a429c94fc0a1ba5edac092acb404f1f183e4f87e051284a10e6ad6214abfd9f
MD5 cba8715c81eeb7b4c76db27789b97266
SHA1 21f9d872318239934a2f4f60f26e490249385b2d
SHA512 53f77053f30b49849df233b1e270b688bc798fb7f0076214a940e856cb206ae953ec1b126843a4c4fe3ca5d0ac02fc38c33a9813559eec1c3bd8358861e4de53
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3220	2848	regsvr32.exe	69
PID 2848 wrote to memory of 3220	2848	regsvr32.exe	69
PID 2848 wrote to memory of 3220	2848	regsvr32.exe	69
PID 3220 wrote to memory of 1276	3220	regsvr32.exe	70
PID 3220 wrote to memory of 1276	3220	regsvr32.exe	70
PID 3220 wrote to memory of 1276	3220	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cba8715c81eeb7b4c76db27789b97266.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cba8715c81eeb7b4c76db27789b97266.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\cba8715c81eeb7b4c76db27789b97266.dll",DllRegisterServer
    3⤵
    PID:1276