8fa8d19ca8875f370b5267c9e666f67d3eeb4ea55d061e6ac0aa618e8ac3d8de

Analysis

Target
emotet_exe_e1_8fa8d19ca8875f370b5267c9e666f67d3eeb4ea55d061e6ac0aa618e8ac3d8de_2021-01-13__115917.exe.dll
Size 271KB
Sample210113-dyf7cgsshx
SHA256 8fa8d19ca8875f370b5267c9e666f67d3eeb4ea55d061e6ac0aa618e8ac3d8de
MD5 6d65571a1d5bb5ce2f3168dbcc6c12c9
SHA1 c5c2903fcdf700d27b240f834f1641b67fa352c7
SHA512 84732ad954375ee0d524c38cad5898cff8c8b1bdfb67c9ae7f8920c2c2f098871d7e1ee87c118c6cf1fd09cbad919a43897715112a1506139f62547ee74f04a3
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	1328	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1328	rundll32.exe
1328	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1328	1824	rundll32.exe	26
PID 1824 wrote to memory of 1328	1824	rundll32.exe	26
PID 1824 wrote to memory of 1328	1824	rundll32.exe	26
PID 1824 wrote to memory of 1328	1824	rundll32.exe	26
PID 1824 wrote to memory of 1328	1824	rundll32.exe	26
PID 1824 wrote to memory of 1328	1824	rundll32.exe	26
PID 1824 wrote to memory of 1328	1824	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_8fa8d19ca8875f370b5267c9e666f67d3eeb4ea55d061e6ac0aa618e8ac3d8de_2021-01-13__115917.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_8fa8d19ca8875f370b5267c9e666f67d3eeb4ea55d061e6ac0aa618e8ac3d8de_2021-01-13__115917.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1328