2f8005abf81a8b9012f7c1ea0bb80e0548242cd7622b7f9512879e283d01b9e9

Analysis

Target
emotet_exe_e5_2f8005abf81a8b9012f7c1ea0bb80e0548242cd7622b7f9512879e283d01b9e9_2021-11-24__204354.exe.dll
Size 471KB
Sample211124-zh55csdfcj
SHA256 2f8005abf81a8b9012f7c1ea0bb80e0548242cd7622b7f9512879e283d01b9e9
MD5 dd660013d0886b4dc01586d20cdf94fa
SHA1 bec7b4c93be92b15064634a98f8dde08a3365624
SHA512 93f049355827d0a86d083e033cc8ef30e9ca1852972d16e8ba98adca74e9743b24a14ce6b4a3d92388e068b347d4336ed93aef898fa4155fd536564e166513b1
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2012 created 3168	2012	WerFault.exe	68

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4076	3168	WerFault.exe	68
2012	3168	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 3168	3480	rundll32.exe	68
PID 3480 wrote to memory of 3168	3480	rundll32.exe	68
PID 3480 wrote to memory of 3168	3480	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2f8005abf81a8b9012f7c1ea0bb80e0548242cd7622b7f9512879e283d01b9e9_2021-11-24__204354.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2f8005abf81a8b9012f7c1ea0bb80e0548242cd7622b7f9512879e283d01b9e9_2021-11-24__204354.exe.dll,#1
  2⤵
  PID:3168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 624
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 640
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2012