82fb0084dba14bf73f865fed31fadbcc1d9b0c87330924f65166337cbe1b6323

Analysis

Target
WafPdavbh4o4J.dll
Size 538KB
Sample220130-rjfl4acbfn
SHA256 82fb0084dba14bf73f865fed31fadbcc1d9b0c87330924f65166337cbe1b6323
MD5 11b7676eb7ab71a5b36b59072772e276
SHA1 c43b2277f870501e519bcddcf19a64baa56dc004
SHA512 4e11f5e67b9d8d5bcbb4526188ddd272f7845792f4827f8a9fbc8e9c57f7391d8ac9a2b7131f7bd17943f4817d57e52b0180d4f7d06f44e43fc6618c74023388
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 1964	3620	regsvr32.exe	68
PID 3620 wrote to memory of 1964	3620	regsvr32.exe	68
PID 3620 wrote to memory of 1964	3620	regsvr32.exe	68
PID 1964 wrote to memory of 4156	1964	regsvr32.exe	69
PID 1964 wrote to memory of 4156	1964	regsvr32.exe	69
PID 1964 wrote to memory of 4156	1964	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\WafPdavbh4o4J.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\WafPdavbh4o4J.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\WafPdavbh4o4J.dll",DllRegisterServer
    3⤵
    PID:4156