2bffe5e50c10299a36490f0c0ab76c4b31acbd111e52684bb141d1bc267493ae

Analysis

Target

emotet_exe_e2_2bffe5e50c10299a36490f0c0ab76c4b31acbd111e52684bb141d1bc267493ae_2021-01-13__000248.exe.dll
Size

269KB
MD5

2c177c13a67a7a8ce5e2c5a0312e3223
SHA1

1158b27db357ba36fc3922d0f85d7be3ab3f3aa7
SHA256

2bffe5e50c10299a36490f0c0ab76c4b31acbd111e52684bb141d1bc267493ae
SHA512

8a0684acf5ac3d079104a6684c0ab1d32728008295417b36f56572178e83ba08ca47ce31a1a0f9d47b79ec8b4036c7437b3ff8d5e79cf5b2ebbfeb1d1b063925

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

22 1208 rundll32.exe
24 1208 rundll32.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rundll32.exe

pid process

1208 rundll32.exe
1208 rundll32.exe
1208 rundll32.exe
1208 rundll32.exe
1208 rundll32.exe
1208 rundll32.exe

flow	pid	process
22	1208	rundll32.exe
24	1208	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 492 wrote to memory of 1208	492	rundll32.exe	rundll32.exe
PID 492 wrote to memory of 1208	492	rundll32.exe	rundll32.exe
PID 492 wrote to memory of 1208	492	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_2bffe5e50c10299a36490f0c0ab76c4b31acbd111e52684bb141d1bc267493ae_2021-01-13__000248.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e2_2bffe5e50c10299a36490f0c0ab76c4b31acbd111e52684bb141d1bc267493ae_2021-01-13__000248.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1208