25fb0a71ad75732672b88e0571fb4ff7deee9cb7dd6bac5d98e6dc77efbb9fbc

Analysis

Target
emotet_exe_e1_25fb0a71ad75732672b88e0571fb4ff7deee9cb7dd6bac5d98e6dc77efbb9fbc_2021-01-14__000143.exe.dll
Size 271KB
Sample210114-ap2rr6d67e
SHA256 25fb0a71ad75732672b88e0571fb4ff7deee9cb7dd6bac5d98e6dc77efbb9fbc
MD5 89844b6587d63a05c26d2a76f293cdc3
SHA1 eb2d3a604bd47c43fead53db5c453df63a2cae3d
SHA512 b2c07086495db5cc4ad23c53280bac861f12f5470665259cf9ac54adb3dc4048672af1cb1e36907ec5468a8ac996e4b72736bd7d3538a27957354e1d893aef64
MD5 SHA1 SHA512

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
16	1600	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1600	580	rundll32.exe	72
PID 580 wrote to memory of 1600	580	rundll32.exe	72
PID 580 wrote to memory of 1600	580	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_25fb0a71ad75732672b88e0571fb4ff7deee9cb7dd6bac5d98e6dc77efbb9fbc_2021-01-14__000143.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e1_25fb0a71ad75732672b88e0571fb4ff7deee9cb7dd6bac5d98e6dc77efbb9fbc_2021-01-14__000143.exe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:1600