accb13a42721d2a173ce26fd35522bf28a8013050394f59fc6dfd496f87f0afe

Analysis

Target
emotet_exe_e5_accb13a42721d2a173ce26fd35522bf28a8013050394f59fc6dfd496f87f0afe_2021-11-18__142229.exe.dll
Size 474KB
Sample211118-rp618shbe2
SHA256 accb13a42721d2a173ce26fd35522bf28a8013050394f59fc6dfd496f87f0afe
MD5 1ea7691731b12a66a682b26f809b0092
SHA1 8cb4d5f28d99e05a54f0af4e2eb3d30a69f899bb
SHA512 f02e217c8ef35f8fe7d5d41736c65759f3052485d66d04fc56aaeb163412bc5bcb48ae42975e326d534cdcb038a52a16e8003ab80f5e7f9f3b592f1829aeabdd
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3988 created 3156	3988	WerFault.exe	68

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4064	3156	WerFault.exe	68
3988	3156	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3156	2804	rundll32.exe	68
PID 2804 wrote to memory of 3156	2804	rundll32.exe	68
PID 2804 wrote to memory of 3156	2804	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_accb13a42721d2a173ce26fd35522bf28a8013050394f59fc6dfd496f87f0afe_2021-11-18__142229.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_accb13a42721d2a173ce26fd35522bf28a8013050394f59fc6dfd496f87f0afe_2021-11-18__142229.exe.dll,#1
  2⤵
  PID:3156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 616
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 636
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3988