047f4da9d21a607b4836b62ed5c6de9b7fc4b9a80737b7cefe76f219cd7ee54f

Analysis

Target
CKbbm7Ys2ga1pZtSon.dll
Size 536KB
Sample220128-wj669sabb5
SHA256 047f4da9d21a607b4836b62ed5c6de9b7fc4b9a80737b7cefe76f219cd7ee54f
MD5 f175837eff94e1b53a0fbb7dd4386b76
SHA1 9fb7c93e54658922ef86d135c441afa126e6bf7e
SHA512 e2e65ef075a5e5469ef28db177dbbb9aeea2f78b04552dc2db4d099d0c15f199e63e0d9048edc14404c9ea5f582841d18c48270e39ef619be1f6dfc9d72e25dc
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 3820	2844	regsvr32.exe	68
PID 2844 wrote to memory of 3820	2844	regsvr32.exe	68
PID 2844 wrote to memory of 3820	2844	regsvr32.exe	68
PID 3820 wrote to memory of 3824	3820	regsvr32.exe	69
PID 3820 wrote to memory of 3824	3820	regsvr32.exe	69
PID 3820 wrote to memory of 3824	3820	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CKbbm7Ys2ga1pZtSon.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\CKbbm7Ys2ga1pZtSon.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CKbbm7Ys2ga1pZtSon.dll",DllRegisterServer
    3⤵
    PID:3824