2878f0f1d42e5cce2a201e686c2f77dae81ea5a44327e2cfc5a9cf103f29c7fa

Analysis

Target
j9hjjKPJde.dll
Size 544KB
Sample220128-wr28aaach7
SHA256 2878f0f1d42e5cce2a201e686c2f77dae81ea5a44327e2cfc5a9cf103f29c7fa
MD5 fcbbbb755e1db653176d93b8b652d88f
SHA1 8805bdcf841b17bfad76729bc81d0261a75c46fc
SHA512 9f318419960fb3151541648ebe170f53bb90e41ef14f5d5497fec0c027127cf68d9a18965270815f7d6b3462070eeee7df14658a65df269eb376be882f1d5b10
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 3108	1900	regsvr32.exe	68
PID 1900 wrote to memory of 3108	1900	regsvr32.exe	68
PID 1900 wrote to memory of 3108	1900	regsvr32.exe	68
PID 3108 wrote to memory of 516	3108	regsvr32.exe	71
PID 3108 wrote to memory of 516	3108	regsvr32.exe	71
PID 3108 wrote to memory of 516	3108	regsvr32.exe	71

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\j9hjjKPJde.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\j9hjjKPJde.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\j9hjjKPJde.dll",DllRegisterServer
    3⤵
    PID:516