0062304503f928e8bb0e8bf3fe2466bb4fe26050bf658cf11b4c91019ddf3c3d

Analysis

Target
emotet_exe_e5_0062304503f928e8bb0e8bf3fe2466bb4fe26050bf658cf11b4c91019ddf3c3d_2021-11-19__071209.exe.dll
Size 477KB
Sample211119-h147caceh4
SHA256 0062304503f928e8bb0e8bf3fe2466bb4fe26050bf658cf11b4c91019ddf3c3d
MD5 4a8f99bc1982d3fcd0a60255bb984d8d
SHA1 e4d1af98ab5f1964a9d4b20defccfbbcbb33e9c9
SHA512 9bcee65d886567f46e164210cea3c542e6c156e4fa16e30dbb5fdb8a10af1eb3664c0d330c7291d4edfa928e37b2a4f2e3a2277f62b6c03b4ed5df0894259465
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 820 created 3524	820	WerFault.exe	68

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4388	3524	WerFault.exe	68
820	3524	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 3524	3692	rundll32.exe	68
PID 3692 wrote to memory of 3524	3692	rundll32.exe	68
PID 3692 wrote to memory of 3524	3692	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0062304503f928e8bb0e8bf3fe2466bb4fe26050bf658cf11b4c91019ddf3c3d_2021-11-19__071209.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0062304503f928e8bb0e8bf3fe2466bb4fe26050bf658cf11b4c91019ddf3c3d_2021-11-19__071209.exe.dll,#1
  2⤵
  PID:3524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 608
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 620
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:820