9d908ca79fd014182d6524176d4dcd3a461c26da7cbb99300c31a7713bdc4f23

Analysis

Target
emotet_exe_e5_9d908ca79fd014182d6524176d4dcd3a461c26da7cbb99300c31a7713bdc4f23_2021-12-01__134424.exe.dll
Size 267KB
Sample211201-q2dpsacehr
SHA256 9d908ca79fd014182d6524176d4dcd3a461c26da7cbb99300c31a7713bdc4f23
MD5 89a14d9e1e0c42a3d7bd039ff74f20c9
SHA1 12e7f22b2c20a01beb61b2fe95f63d7f2a9e25de
SHA512 918c90e038b7fdabb1c6794beed91f25fd2e3431e41c78309b445416802a184fb6422a92b4771f492f8c276be4d939975f18ced74c783bad1ce65b64c948b92a
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	2776	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 2776	3140	rundll32.exe	68
PID 3140 wrote to memory of 2776	3140	rundll32.exe	68
PID 3140 wrote to memory of 2776	3140	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9d908ca79fd014182d6524176d4dcd3a461c26da7cbb99300c31a7713bdc4f23_2021-12-01__134424.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9d908ca79fd014182d6524176d4dcd3a461c26da7cbb99300c31a7713bdc4f23_2021-12-01__134424.exe.dll,#1
  2⤵
  PID:2776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 584
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2308