cc572d7dda3f7af6d2eb196ed1884004be047dfba7bc85f157064ff6a4f01734

Analysis

Target
emotet_exe_e5_cc572d7dda3f7af6d2eb196ed1884004be047dfba7bc85f157064ff6a4f01734_2021-11-20__000004.exe.dll
Size 470KB
Sample211120-aawhhsfac2
SHA256 cc572d7dda3f7af6d2eb196ed1884004be047dfba7bc85f157064ff6a4f01734
MD5 45ddb4f4715434565857eebc761f3f3e
SHA1 ca4e791de0b983121cb7e45ce937d615d4d610e6
SHA512 a060703be8b16739de3e766cc82b2c658bd23b72ab198c0e069f4fdd0fda7ea3af28f51c56c008b9f4e61a6a327f39940202b1d7f1e3e6fa28fc08440708151a
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 752 created 3480	752	WerFault.exe	68

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2084	3480	WerFault.exe	68
752	3480	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 3480	2896	rundll32.exe	68
PID 2896 wrote to memory of 3480	2896	rundll32.exe	68
PID 2896 wrote to memory of 3480	2896	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cc572d7dda3f7af6d2eb196ed1884004be047dfba7bc85f157064ff6a4f01734_2021-11-20__000004.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cc572d7dda3f7af6d2eb196ed1884004be047dfba7bc85f157064ff6a4f01734_2021-11-20__000004.exe.dll,#1
  2⤵
  PID:3480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 616
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 608
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:752