b98d0bd4a8fa89906859f378ea7b924c554443f633bcafc84b0e85c06bed8eb3

Analysis

Target

emotet_exe_e2_b98d0bd4a8fa89906859f378ea7b924c554443f633bcafc84b0e85c06bed8eb3_2021-01-13__112654.exe.dll
Size

273KB
MD5

fd7c848498f9ffc17b7ad2786f55d01a
SHA1

499e4fdfe03172044db76b06bbcece8e5a6a5e37
SHA256

b98d0bd4a8fa89906859f378ea7b924c554443f633bcafc84b0e85c06bed8eb3
SHA512

a41dc2d78dd9ec2515899b20b0492385c4dca073538e3708be42cd5a1eb0eef3c39246711a12005d0ca15538c8293830110ee7f4b330c874ca21c858e7a16882

Score

8^/10

Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

14 1392 rundll32.exe
17 1392 rundll32.exe
19 1392 rundll32.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

rundll32.exe

pid process

1392 rundll32.exe
1392 rundll32.exe
1392 rundll32.exe
1392 rundll32.exe
1392 rundll32.exe
1392 rundll32.exe
1392 rundll32.exe
1392 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1304 wrote to memory of 1392	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1392	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1392	1304	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_b98d0bd4a8fa89906859f378ea7b924c554443f633bcafc84b0e85c06bed8eb3_2021-01-13__112654.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_b98d0bd4a8fa89906859f378ea7b924c554443f633bcafc84b0e85c06bed8eb3_2021-01-13__112654.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1392