76816ba1a506eba7151bce38b3e6d673362355063c8fd92444b6bec5ad106c21

Analysis

Target
emotet_exe_e5_76816ba1a506eba7151bce38b3e6d673362355063c8fd92444b6bec5ad106c21_2021-11-21__000227.exe.dll
Size 470KB
Sample211121-ab2e6agdf9
SHA256 76816ba1a506eba7151bce38b3e6d673362355063c8fd92444b6bec5ad106c21
MD5 bff35e1a659959ba66ce9709382e24b9
SHA1 0fa4e0f8fe2d1e40b541c1b074ddf75a5fa344ca
SHA512 f29195e62e7538da322a690e0ad2322961a21660f07d34d4a37e3831b29bf4e6d1f1d972a0198cab476191aa5985accd4e05e0a4bcdb2eef59fe2bd6543fbb3f
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2888 created 3380	2888	WerFault.exe	69

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1900	3380	WerFault.exe	69
2888	3380	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 3380	412	rundll32.exe	69
PID 412 wrote to memory of 3380	412	rundll32.exe	69
PID 412 wrote to memory of 3380	412	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_76816ba1a506eba7151bce38b3e6d673362355063c8fd92444b6bec5ad106c21_2021-11-21__000227.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_76816ba1a506eba7151bce38b3e6d673362355063c8fd92444b6bec5ad106c21_2021-11-21__000227.exe.dll,#1
  2⤵
  PID:3380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 616
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 608
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2888