ce896fcc7fb5fc6625bbbcfb3b3a20274ef57902d020fd34a673b89ad3edcbb6

Analysis

Target
emotet_exe_e5_ce896fcc7fb5fc6625bbbcfb3b3a20274ef57902d020fd34a673b89ad3edcbb6_2021-11-24__204353.exe.dll
Size 471KB
Sample211124-zh55csdfbq
SHA256 ce896fcc7fb5fc6625bbbcfb3b3a20274ef57902d020fd34a673b89ad3edcbb6
MD5 9e7d45a383dc99d57a79cf2a7a67e0d4
SHA1 945d71cbe006e76a0b65cef443c362a9cae70a9e
SHA512 27d50a03c3ff85726f5c2bbf98eecca8947cc220f4f40a7875ebca70998fa7a55c644deea3848b9fe528ad08f21bb94fd7f1c373d9781852b146fd921d4b0080
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3160 created 2256	3160	WerFault.exe	68

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4396	2256	WerFault.exe	68
3160	2256	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 2256	3708	rundll32.exe	68
PID 3708 wrote to memory of 2256	3708	rundll32.exe	68
PID 3708 wrote to memory of 2256	3708	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ce896fcc7fb5fc6625bbbcfb3b3a20274ef57902d020fd34a673b89ad3edcbb6_2021-11-24__204353.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ce896fcc7fb5fc6625bbbcfb3b3a20274ef57902d020fd34a673b89ad3edcbb6_2021-11-24__204353.exe.dll,#1
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 608
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 184
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3160