b8249c8e5f56f014bc87729024e71f8c6bde452772ca2dfa1a8ba4cf4df6e023

Analysis

Target
dd1Zhe7x1ww.dll
Size 512KB
Sample220128-wj669shghl
SHA256 b8249c8e5f56f014bc87729024e71f8c6bde452772ca2dfa1a8ba4cf4df6e023
MD5 ac32a27b1776e6516b7b7b87f461c8af
SHA1 5167070141a804ef08af7477c29acd33881cb65a
SHA512 3825b388ae9efa74a2732a59374456376a7a19e4eab0a7162ace7b253b2681840dc636208e1ac0b97917e1f7712b16382aeaa90c9bcf98c93af7e057df0844b8
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 3876	912	regsvr32.exe	69
PID 912 wrote to memory of 3876	912	regsvr32.exe	69
PID 912 wrote to memory of 3876	912	regsvr32.exe	69
PID 3876 wrote to memory of 2524	3876	regsvr32.exe	70
PID 3876 wrote to memory of 2524	3876	regsvr32.exe	70
PID 3876 wrote to memory of 2524	3876	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dd1Zhe7x1ww.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dd1Zhe7x1ww.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\dd1Zhe7x1ww.dll",DllRegisterServer
    3⤵
    PID:2524