7602e725df3f2b046f7b9c4f6a7e400a53837b45367b97196f1eabe6dcef1ff9 | Triage™

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-en-20211014
submitted
26/11/2021, 09:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Emotet_n2.bin.dll
Size 474KB
Sample211126-kywtasbdfl
SHA256 7602e725df3f2b046f7b9c4f6a7e400a53837b45367b97196f1eabe6dcef1ff9
MD5 65e2eb7a556242501a095b8249316ea3
SHA1 24f9eec087eef53a1f78d3a74134ac859258e9e3
SHA512 8f5f2fa90e47038512174d6e080e25984afdbd347163e6ebf112a8a221d4a7af137f6acfd780476d32ac4e93fa46bc649e6664bf02f7f0401d6b5e2d00c3737d
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 608	1360	rundll32.exe	27
PID 1360 wrote to memory of 608	1360	rundll32.exe	27
PID 1360 wrote to memory of 608	1360	rundll32.exe	27
PID 1360 wrote to memory of 608	1360	rundll32.exe	27
PID 1360 wrote to memory of 608	1360	rundll32.exe	27
PID 1360 wrote to memory of 608	1360	rundll32.exe	27
PID 1360 wrote to memory of 608	1360	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Emotet_n2.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Emotet_n2.bin.dll,#1
  2⤵
  PID:608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/608-56-0x0000000074F61000-0x0000000074F63000-memory.dmp

Download