7fb3049b0bf12cd43e423ae1b9a08d060918a8efc1569d06cdc4f0e5f25eb849

Analysis

Target
emotet_exe_e5_7fb3049b0bf12cd43e423ae1b9a08d060918a8efc1569d06cdc4f0e5f25eb849_2021-11-19__000023.exe.dll
Size 474KB
Sample211119-aaxetagcdj
SHA256 7fb3049b0bf12cd43e423ae1b9a08d060918a8efc1569d06cdc4f0e5f25eb849
MD5 a33d45c671e09d3e681eec8d43f4f859
SHA1 f84d960f47f6e7c931211b44df0c5e2fd5b5751e
SHA512 10f5cff315f25deb67b933c4d745f3e156f067e758ad5ca4b56cb31c520ab7f99bbd590d6b0c04f99ad3905162b268eb7a532cce281c6a60603d476040bd3f02
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2888 created 1332	2888	WerFault.exe	68

Program crash 2 IoCs

pid	pid_target	Process	procid_target
748	1332	WerFault.exe	68
2888	1332	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 1332	644	rundll32.exe	68
PID 644 wrote to memory of 1332	644	rundll32.exe	68
PID 644 wrote to memory of 1332	644	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7fb3049b0bf12cd43e423ae1b9a08d060918a8efc1569d06cdc4f0e5f25eb849_2021-11-19__000023.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_7fb3049b0bf12cd43e423ae1b9a08d060918a8efc1569d06cdc4f0e5f25eb849_2021-11-19__000023.exe.dll,#1
  2⤵
  PID:1332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 616
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 632
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2888