f9e1b462ba46330f565d8177bb919e16c28e33c87795c0e69e70a6b9b5379ae1

Analysis

Target

emotet_exe_e1_f9e1b462ba46330f565d8177bb919e16c28e33c87795c0e69e70a6b9b5379ae1_2021-01-13__115918.exe.dll
Size

271KB
MD5

9ae30ac08cd4f48f7e3ab9f954f128fd
SHA1

afd1652a90606c26ea30cba2833c03a47101e6d2
SHA256

f9e1b462ba46330f565d8177bb919e16c28e33c87795c0e69e70a6b9b5379ae1
SHA512

4656a482324a5c82c3e53eae13d82c0267f2e406e9a9af1ab80154d3d3f2a5e1da73dc3e4490792f57c78c671bb67f4e413a54ffde33766c27592a623a76a87a

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

6 1520 rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1520 rundll32.exe
1520 rundll32.exe

flow	pid	process
6	1520	rundll32.exe

pid	process
1520	rundll32.exe
1520	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1972 wrote to memory of 1520	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1520	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1520	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1520	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1520	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1520	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1520	1972	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_f9e1b462ba46330f565d8177bb919e16c28e33c87795c0e69e70a6b9b5379ae1_2021-01-13__115918.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_f9e1b462ba46330f565d8177bb919e16c28e33c87795c0e69e70a6b9b5379ae1_2021-01-13__115918.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1520

memory/1520-2-0x0000000000000000-mapping.dmp

Download
memory/1656-3-0x000007FEF7180000-0x000007FEF73FA000-memory.dmp

Filesize
2.5MB

Download