5beab6db846d1ee4b16aab16146bdc1a5f3cd642e14fc1afc317bd83deabef77

Analysis

Target
5d45434ac24d559dd6fbe26633cf91b9.dll
Size 254KB
Sample220202-m7emgshgen
SHA256 5beab6db846d1ee4b16aab16146bdc1a5f3cd642e14fc1afc317bd83deabef77
MD5 5d45434ac24d559dd6fbe26633cf91b9
SHA1 450a8d58a3508b576f3d520049c02cc06eaf0012
SHA512 06eb8a531d038cc2bb20adc54d62bd98f6e2b338f0a3f6d5377a2be8084dc8f8d951d6a5d6b75c2fa0b9fba48a790a281533893c1e9d5bccbc4e88b6492cfb80
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2508	1508	regsvr32.exe	54
PID 1508 wrote to memory of 2508	1508	regsvr32.exe	54
PID 1508 wrote to memory of 2508	1508	regsvr32.exe	54
PID 2508 wrote to memory of 496	2508	regsvr32.exe	57
PID 2508 wrote to memory of 496	2508	regsvr32.exe	57
PID 2508 wrote to memory of 496	2508	regsvr32.exe	57

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5d45434ac24d559dd6fbe26633cf91b9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5d45434ac24d559dd6fbe26633cf91b9.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\5d45434ac24d559dd6fbe26633cf91b9.dll",DllRegisterServer
    3⤵
    PID:496