cc572d7dda3f7af6d2eb196ed1884004be047dfba7bc85f157064ff6a4f01734

Analysis

Target
emotet_exe_e5_cc572d7dda3f7af6d2eb196ed1884004be047dfba7bc85f157064ff6a4f01734_2021-11-20__000004.exe.dll
Size 470KB
Sample211120-aawhhsfac2
SHA256 cc572d7dda3f7af6d2eb196ed1884004be047dfba7bc85f157064ff6a4f01734
MD5 45ddb4f4715434565857eebc761f3f3e
SHA1 ca4e791de0b983121cb7e45ce937d615d4d610e6
SHA512 a060703be8b16739de3e766cc82b2c658bd23b72ab198c0e069f4fdd0fda7ea3af28f51c56c008b9f4e61a6a327f39940202b1d7f1e3e6fa28fc08440708151a
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2032	1592	rundll32.exe	27
PID 1592 wrote to memory of 2032	1592	rundll32.exe	27
PID 1592 wrote to memory of 2032	1592	rundll32.exe	27
PID 1592 wrote to memory of 2032	1592	rundll32.exe	27
PID 1592 wrote to memory of 2032	1592	rundll32.exe	27
PID 1592 wrote to memory of 2032	1592	rundll32.exe	27
PID 1592 wrote to memory of 2032	1592	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cc572d7dda3f7af6d2eb196ed1884004be047dfba7bc85f157064ff6a4f01734_2021-11-20__000004.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cc572d7dda3f7af6d2eb196ed1884004be047dfba7bc85f157064ff6a4f01734_2021-11-20__000004.exe.dll,#1
  2⤵
  PID:2032

memory/2032-56-0x0000000075881000-0x0000000075883000-memory.dmp

Download