b9cce26aa6b5f9d41789bef3116babe3848640f0a67f5a0504efd6439230d64f

Analysis

Target
KcxJcxf8Rvn6.dll
Size 536KB
Sample220128-ws75xsadc5
SHA256 b9cce26aa6b5f9d41789bef3116babe3848640f0a67f5a0504efd6439230d64f
MD5 3138bd8307736368c53ad8c38eb5374a
SHA1 b59501e9039bc67bd676ada2452abc0472a17c67
SHA512 3eaf3edfc400f3f564f9665d0dc696098081e8af5ed3613e5ec673ff86647ba286445f653b6221e3d5289e95f782d6b2b47f69c2c4fbae6ed38442c1ec455732
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1188	1160	regsvr32.exe	69
PID 1160 wrote to memory of 1188	1160	regsvr32.exe	69
PID 1160 wrote to memory of 1188	1160	regsvr32.exe	69
PID 1188 wrote to memory of 1192	1188	regsvr32.exe	70
PID 1188 wrote to memory of 1192	1188	regsvr32.exe	70
PID 1188 wrote to memory of 1192	1188	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\KcxJcxf8Rvn6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\KcxJcxf8Rvn6.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\KcxJcxf8Rvn6.dll",DllRegisterServer
    3⤵
    PID:1192