e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450

Analysis

Target
emotet_exe_e1_e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450_2021-01-14__000144.exe.dll
Size 271KB
Sample210114-2s9c3ncpsx
SHA256 e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450
MD5 bae07e12cb838c3d2d73c05d22c8c386
SHA1 e8d71cc422b53edbf46d08e80e85e5ace9992523
SHA512 93d34a4486f7bf4e1feab192b004301fb623bc12e25804ae579ee5440299bdd43f2b3a3cb476333a1ec27ff395675040456e83fce55d898ca360a26714e3b37b
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
14	2728	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2728	1404	rundll32.exe	73
PID 1404 wrote to memory of 2728	1404	rundll32.exe	73
PID 1404 wrote to memory of 2728	1404	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450_2021-01-14__000144.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_e24c3f5539484830fa7fe0615578d543a2e90715fbf04390bfddbbfd62e4c450_2021-01-14__000144.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:2728