f22d49e91603d41e8a8c1c365a4629d79292dcaf39dec17cca0f1bf37eaad5ba

Analysis

Target
emotet_exe_e5_f22d49e91603d41e8a8c1c365a4629d79292dcaf39dec17cca0f1bf37eaad5ba_2021-12-01__134422.exe.dll
Size 267KB
Sample211201-q2dpsaffb7
SHA256 f22d49e91603d41e8a8c1c365a4629d79292dcaf39dec17cca0f1bf37eaad5ba
MD5 34de7ec4825cc7df47b43201891adced
SHA1 0b98a4fbec341fec043a6842b9abaaf5efb1a98b
SHA512 fdd274f9d51a2461571620775fc06893c3e268ca4397c795cbb96eff6bac791feb6f6298bb36ae21bd3f35a6ef2643874dbb6ed36ba98acd566fc05ae73f66b4
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 852	880	rundll32.exe	28
PID 880 wrote to memory of 852	880	rundll32.exe	28
PID 880 wrote to memory of 852	880	rundll32.exe	28
PID 880 wrote to memory of 852	880	rundll32.exe	28
PID 880 wrote to memory of 852	880	rundll32.exe	28
PID 880 wrote to memory of 852	880	rundll32.exe	28
PID 880 wrote to memory of 852	880	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f22d49e91603d41e8a8c1c365a4629d79292dcaf39dec17cca0f1bf37eaad5ba_2021-12-01__134422.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f22d49e91603d41e8a8c1c365a4629d79292dcaf39dec17cca0f1bf37eaad5ba_2021-12-01__134422.exe.dll,#1
  2⤵
  PID:852

memory/852-56-0x0000000075881000-0x0000000075883000-memory.dmp

Download