5eadfa4dd6b036fb7cc42f1c023fde4579c2d2ab49e4c84b93f6e207272b07b3

Analysis

Target
emotet_exe_e1_5eadfa4dd6b036fb7cc42f1c023fde4579c2d2ab49e4c84b93f6e207272b07b3_2020-12-21__141521.exe.dll
Size 225KB
Sample201221-x7q7a39txa
SHA256 5eadfa4dd6b036fb7cc42f1c023fde4579c2d2ab49e4c84b93f6e207272b07b3
MD5 466985f20b50a18a2e808d2b98c24331
SHA1 52ac3c024b0c6ab9cfed38c426d2c4c1d9876aba
SHA512 edfe617c2cc722f2cd529e45074f33125e3b88b66228fec132ada4796e335aa3a1e3cbe0c6d45fe4eddf60f9aa7dc464a233eda1fd73abd6d1e0fdeeda4e1f34
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
13	2280	rundll32.exe
16	2280	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2280	756	rundll32.exe	71
PID 756 wrote to memory of 2280	756	rundll32.exe	71
PID 756 wrote to memory of 2280	756	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_5eadfa4dd6b036fb7cc42f1c023fde4579c2d2ab49e4c84b93f6e207272b07b3_2020-12-21__141521.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_5eadfa4dd6b036fb7cc42f1c023fde4579c2d2ab49e4c84b93f6e207272b07b3_2020-12-21__141521.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2280

memory/2280-3-0x0000000000FC0000-0x0000000000FE2000-memory.dmp

Download