bac05f843487fae8a21394e1c27a77bf879acbcf72d3d2cc9a66dd78a8293d5e

Analysis

Target
emotet_exe_e5_bac05f843487fae8a21394e1c27a77bf879acbcf72d3d2cc9a66dd78a8293d5e_2021-11-25__000232.exe.dll
Size 471KB
Sample211125-ab2qxshbf4
SHA256 bac05f843487fae8a21394e1c27a77bf879acbcf72d3d2cc9a66dd78a8293d5e
MD5 5a9a4c15a5772c278befe163218c467a
SHA1 00ca1fddb6fc43757ae1f17bc82806d3e0fd877e
SHA512 742812f4228050272bf1ce82b560a8a77db29dfc512e286e83be01e98cf8b02e70be80935875537020ccb7ee8bd28bcbbf7b3e3ae007ef684d5eeb928fa7ee4b
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4408 created 4148	4408	WerFault.exe	68

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2188	4148	WerFault.exe	68
4408	4148	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4148	3512	rundll32.exe	68
PID 3512 wrote to memory of 4148	3512	rundll32.exe	68
PID 3512 wrote to memory of 4148	3512	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bac05f843487fae8a21394e1c27a77bf879acbcf72d3d2cc9a66dd78a8293d5e_2021-11-25__000232.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bac05f843487fae8a21394e1c27a77bf879acbcf72d3d2cc9a66dd78a8293d5e_2021-11-25__000232.exe.dll,#1
  2⤵
  PID:4148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 608
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 636
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4408