be829b878815b7343c1d9ee8d18d9fd3173d88ff6193ce4b688460bd858e7e43 | Triage

Analysis

max time kernel
72s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
22-01-2021 11:33

Sharing

Report Analysis Logs

General

Target

emotet_exe_e3_be829b878815b7343c1d9ee8d18d9fd3173d88ff6193ce4b688460bd858e7e43_2021-01-22__113245._exe.dll
Size

266KB
MD5

a1fbbb28e61acd5ea5e0ebcfb6800066
SHA1

3c7323c0d1c8180fa64ca8b6c6b82fe4e30ad92e
SHA256

be829b878815b7343c1d9ee8d18d9fd3173d88ff6193ce4b688460bd858e7e43
SHA512

c4a1ab610fa1b3efd693442e4154f8bcba529200e4411512722014859b6d2584f94609ee3948404b2169b06ca624e41d0db6a537c64287f2ebfc52102e81e53c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3636 wrote to memory of 3696	3636	rundll32.exe	rundll32.exe
PID 3636 wrote to memory of 3696	3636	rundll32.exe	rundll32.exe
PID 3636 wrote to memory of 3696	3636	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_be829b878815b7343c1d9ee8d18d9fd3173d88ff6193ce4b688460bd858e7e43_2021-01-22__113245._exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3636

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e3_be829b878815b7343c1d9ee8d18d9fd3173d88ff6193ce4b688460bd858e7e43_2021-01-22__113245._exe.dll,#1
2⤵
PID:3696

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3696-2-0x0000000000000000-mapping.dmp

Download