c31e83ad39a2fb74f7a9bccb0f5f5c7b5c346feefb1ca4d34d715247f63a342f

Analysis

Target
gzwA8IdsA8ZV1tcIqdR.dll
Size 544KB
Sample220128-wr28aaach8
SHA256 c31e83ad39a2fb74f7a9bccb0f5f5c7b5c346feefb1ca4d34d715247f63a342f
MD5 8d91a185b12323fb33ff5a5a5557b288
SHA1 5a193df9a7bcaef697692747e5b8bb76badc98a1
SHA512 526d8e1069968a9c5cbb55ef774173eccc80e0100564332916a922b8bac7f2caa68ae508b2ca122c5e08afecb679c43242ea3fb4a3344b397c27007d992e873c
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2512	2472	regsvr32.exe	68
PID 2472 wrote to memory of 2512	2472	regsvr32.exe	68
PID 2472 wrote to memory of 2512	2472	regsvr32.exe	68
PID 2512 wrote to memory of 3036	2512	regsvr32.exe	69
PID 2512 wrote to memory of 3036	2512	regsvr32.exe	69
PID 2512 wrote to memory of 3036	2512	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\gzwA8IdsA8ZV1tcIqdR.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\gzwA8IdsA8ZV1tcIqdR.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\gzwA8IdsA8ZV1tcIqdR.dll",DllRegisterServer
    3⤵
    PID:3036