3932d171872a482e4e664644292f80c284d7a9e8919aaa9e6820f34d4cd9c7e6

Analysis

Target
8732f104a805dd2047f337efbd024657.dll
Size 536KB
Sample220128-wjk9sshgfp
SHA256 3932d171872a482e4e664644292f80c284d7a9e8919aaa9e6820f34d4cd9c7e6
MD5 8732f104a805dd2047f337efbd024657
SHA1 7b6781e1e5a07a0af44dd930acb1045099532635
SHA512 e4217c0ffcd7671429e81388b23ece62e57f9261dacece86ee2717e3d4fb77547bc9adb9f54e9fb9b8532a9cc4443660178aa0a03d744f8b68783a6a5b9ec916
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 728	860	regsvr32.exe	69
PID 860 wrote to memory of 728	860	regsvr32.exe	69
PID 860 wrote to memory of 728	860	regsvr32.exe	69
PID 728 wrote to memory of 2912	728	regsvr32.exe	70
PID 728 wrote to memory of 2912	728	regsvr32.exe	70
PID 728 wrote to memory of 2912	728	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8732f104a805dd2047f337efbd024657.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8732f104a805dd2047f337efbd024657.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:728
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\8732f104a805dd2047f337efbd024657.dll",DllRegisterServer
    3⤵
    PID:2912