b21188a7eb5209c09dda0cc8baa89dcdc5f0519d217f6e870d1fb70d39d84b23

Analysis

Target

emotet_exe_e1_b21188a7eb5209c09dda0cc8baa89dcdc5f0519d217f6e870d1fb70d39d84b23_2021-01-13__000233.exe.dll
Size

275KB
MD5

250109bc476bb796261eb723b949d29f
SHA1

702e110127b5c2bc56169e338523addbebdf5ddd
SHA256

b21188a7eb5209c09dda0cc8baa89dcdc5f0519d217f6e870d1fb70d39d84b23
SHA512

ce2ca1e9b815c21a55926792e596c154d888c3e358e2f93b9e3a3d009c962d71446bf6ee7533ed8555bec94c6681fa11bdd242863d1fe6f76bee469ec34aec50

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

5 1604 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1604 rundll32.exe
1604 rundll32.exe

flow	pid	process
5	1604	rundll32.exe

pid	process
1604	rundll32.exe
1604	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 324 wrote to memory of 1604	324	rundll32.exe	rundll32.exe
PID 324 wrote to memory of 1604	324	rundll32.exe	rundll32.exe
PID 324 wrote to memory of 1604	324	rundll32.exe	rundll32.exe
PID 324 wrote to memory of 1604	324	rundll32.exe	rundll32.exe
PID 324 wrote to memory of 1604	324	rundll32.exe	rundll32.exe
PID 324 wrote to memory of 1604	324	rundll32.exe	rundll32.exe
PID 324 wrote to memory of 1604	324	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_b21188a7eb5209c09dda0cc8baa89dcdc5f0519d217f6e870d1fb70d39d84b23_2021-01-13__000233.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_b21188a7eb5209c09dda0cc8baa89dcdc5f0519d217f6e870d1fb70d39d84b23_2021-01-13__000233.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1604

memory/1332-3-0x000007FEF7D30000-0x000007FEF7FAA000-memory.dmp

Filesize
2.5MB

Download
memory/1604-2-0x0000000000000000-mapping.dmp

Download