edd93ebe989113ce36f1d02759f2e617d73169557dcb84163db91e5a14f9c752

Analysis

Target
emotet_exe_e5_edd93ebe989113ce36f1d02759f2e617d73169557dcb84163db91e5a14f9c752_2021-11-24__204356.exe.dll
Size 471KB
Sample211124-zh55csdfck
SHA256 edd93ebe989113ce36f1d02759f2e617d73169557dcb84163db91e5a14f9c752
MD5 cf346e278e8f2ee37d895d40a7d26511
SHA1 11c188efe2b629f662dc475a86e00c3fa4751b89
SHA512 a5d660ee9abbb947b401020a93735dab6b20384b360b378283b3f07b2c00b44bf457271eb5ee2bd27ca041b7582bc0039d889e5e4e06d7191490412d3b80cf01
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1404 created 2136	1404	WerFault.exe	68

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2980	2136	WerFault.exe	68
1404	2136	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2136	3028	rundll32.exe	68
PID 3028 wrote to memory of 2136	3028	rundll32.exe	68
PID 3028 wrote to memory of 2136	3028	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_edd93ebe989113ce36f1d02759f2e617d73169557dcb84163db91e5a14f9c752_2021-11-24__204356.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_edd93ebe989113ce36f1d02759f2e617d73169557dcb84163db91e5a14f9c752_2021-11-24__204356.exe.dll,#1
  2⤵
  PID:2136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 624
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 452
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1404