74781ef4b04689d9782c61c4ce5f28cd055e00ef234da80bc465f5bc79f04c3b

Analysis

Target
emotet_exe_e3_74781ef4b04689d9782c61c4ce5f28cd055e00ef234da80bc465f5bc79f04c3b_2021-01-13__000307.exe.dll
Size 239KB
Sample210113-q8ephj7ws6
SHA256 74781ef4b04689d9782c61c4ce5f28cd055e00ef234da80bc465f5bc79f04c3b
MD5 142d5ba556836b61131e9e99421f7e46
SHA1 8a96f76b77134e848617f086e0d1bccb65a63f11
SHA512 71ca536197270d52e289e6a82f61a2f19cf520f07acc7ec9392df5603896d0425c498d870ec3e93619b3b271fe8b09047bc49ad8a002a53389da2586fa3b737f
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
17	4796	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4796	4688	rundll32.exe	69
PID 4688 wrote to memory of 4796	4688	rundll32.exe	69
PID 4688 wrote to memory of 4796	4688	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_74781ef4b04689d9782c61c4ce5f28cd055e00ef234da80bc465f5bc79f04c3b_2021-01-13__000307.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_74781ef4b04689d9782c61c4ce5f28cd055e00ef234da80bc465f5bc79f04c3b_2021-01-13__000307.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4796