d96793e74d9d81ef432fc9a2bcaddb46b2d5a26a418f534fe27cdd5fbf894460

Analysis

Target
emotet_exe_e1_d96793e74d9d81ef432fc9a2bcaddb46b2d5a26a418f534fe27cdd5fbf894460_2021-01-13__000232.exe.dll
Size 275KB
Sample210113-2qtpvslcta
SHA256 d96793e74d9d81ef432fc9a2bcaddb46b2d5a26a418f534fe27cdd5fbf894460
MD5 7161bd4296db7ad19ab80113c916b2f7
SHA1 8d14f6f4d72689e13f68348324bb946b4de95367
SHA512 865e842e8583b8385d6329b321688a3753ce10cab6993443f46eef526dc8c6bc799b899134d61638e80d4197c968cfe181ce6a727e0c2a813ea700c791716437
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
21	4004	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 4004	1048	rundll32.exe	71
PID 1048 wrote to memory of 4004	1048	rundll32.exe	71
PID 1048 wrote to memory of 4004	1048	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_d96793e74d9d81ef432fc9a2bcaddb46b2d5a26a418f534fe27cdd5fbf894460_2021-01-13__000232.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_d96793e74d9d81ef432fc9a2bcaddb46b2d5a26a418f534fe27cdd5fbf894460_2021-01-13__000232.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4004