d96793e74d9d81ef432fc9a2bcaddb46b2d5a26a418f534fe27cdd5fbf894460

Analysis

Target

emotet_exe_e1_d96793e74d9d81ef432fc9a2bcaddb46b2d5a26a418f534fe27cdd5fbf894460_2021-01-13__000232.exe.dll
Size

275KB
MD5

7161bd4296db7ad19ab80113c916b2f7
SHA1

8d14f6f4d72689e13f68348324bb946b4de95367
SHA256

d96793e74d9d81ef432fc9a2bcaddb46b2d5a26a418f534fe27cdd5fbf894460
SHA512

865e842e8583b8385d6329b321688a3753ce10cab6993443f46eef526dc8c6bc799b899134d61638e80d4197c968cfe181ce6a727e0c2a813ea700c791716437

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

5 1884 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1884 rundll32.exe
1884 rundll32.exe

flow	pid	process
5	1884	rundll32.exe

pid	process
1884	rundll32.exe
1884	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1640 wrote to memory of 1884	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1884	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1884	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1884	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1884	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1884	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1884	1640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_d96793e74d9d81ef432fc9a2bcaddb46b2d5a26a418f534fe27cdd5fbf894460_2021-01-13__000232.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_d96793e74d9d81ef432fc9a2bcaddb46b2d5a26a418f534fe27cdd5fbf894460_2021-01-13__000232.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1884

memory/1668-3-0x000007FEF7B10000-0x000007FEF7D8A000-memory.dmp

Filesize
2.5MB

Download
memory/1884-2-0x0000000000000000-mapping.dmp

Download