4a91efce913eb758fc2fc521d9d3aa03435dca6f31042d3238a2ba4fa9c3d44a

Analysis

Target
emotet_exe_e2_4a91efce913eb758fc2fc521d9d3aa03435dca6f31042d3238a2ba4fa9c3d44a_2021-01-12__153732.exe.dll
Size 269KB
Sample210112-6xjb63glc6
SHA256 4a91efce913eb758fc2fc521d9d3aa03435dca6f31042d3238a2ba4fa9c3d44a
MD5 62e2ac0f5967d0eb97ff209d99198ad1
SHA1 7ca64f7c3786e706aa22dab2f5adcea958d1d7fa
SHA512 61fa8db7846c7a54ebf3ea48ec7646d96e94b8b9b0c373fdd005b349e079b8d9a8a9d3e02da91204647329db931e6be94cf10c339259692e95962c66ae604e34
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
23	3012	rundll32.exe
24	3012	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 3012	3564	rundll32.exe	46
PID 3564 wrote to memory of 3012	3564	rundll32.exe	46
PID 3564 wrote to memory of 3012	3564	rundll32.exe	46

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_4a91efce913eb758fc2fc521d9d3aa03435dca6f31042d3238a2ba4fa9c3d44a_2021-01-12__153732.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_4a91efce913eb758fc2fc521d9d3aa03435dca6f31042d3238a2ba4fa9c3d44a_2021-01-12__153732.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3012