d793dee3a6ed96311d8dffe9aa40a31f7ee1c03a3475b46879cd1ac25411a05d

Analysis

Target
emotet_exe_e5_d793dee3a6ed96311d8dffe9aa40a31f7ee1c03a3475b46879cd1ac25411a05d_2021-12-01__134421.exe.dll
Size 267KB
Sample211201-q2dpsacehq
SHA256 d793dee3a6ed96311d8dffe9aa40a31f7ee1c03a3475b46879cd1ac25411a05d
MD5 59b6063e6ab8d23f7182b696094d0f4e
SHA1 2a486859d61bf106546e47f04b1e6ced553f9660
SHA512 888fe1f20af946c483056cec88d1cbc0d9083da75599056e8727bb71a12022782f0c891f0951bdeb13300b1ba2b5e7ccbeb0b56dc5a15e75e0852585cf2ce7cb
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
856	2856	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2856	2804	rundll32.exe	68
PID 2804 wrote to memory of 2856	2804	rundll32.exe	68
PID 2804 wrote to memory of 2856	2804	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d793dee3a6ed96311d8dffe9aa40a31f7ee1c03a3475b46879cd1ac25411a05d_2021-12-01__134421.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d793dee3a6ed96311d8dffe9aa40a31f7ee1c03a3475b46879cd1ac25411a05d_2021-12-01__134421.exe.dll,#1
  2⤵
  PID:2856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 584
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:856