f22d49e91603d41e8a8c1c365a4629d79292dcaf39dec17cca0f1bf37eaad5ba

Analysis

Target
emotet_exe_e5_f22d49e91603d41e8a8c1c365a4629d79292dcaf39dec17cca0f1bf37eaad5ba_2021-12-01__134422.exe.dll
Size 267KB
Sample211201-q2dpsaffb7
SHA256 f22d49e91603d41e8a8c1c365a4629d79292dcaf39dec17cca0f1bf37eaad5ba
MD5 34de7ec4825cc7df47b43201891adced
SHA1 0b98a4fbec341fec043a6842b9abaaf5efb1a98b
SHA512 fdd274f9d51a2461571620775fc06893c3e268ca4397c795cbb96eff6bac791feb6f6298bb36ae21bd3f35a6ef2643874dbb6ed36ba98acd566fc05ae73f66b4
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
796	3920	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 3920	3720	rundll32.exe	69
PID 3720 wrote to memory of 3920	3720	rundll32.exe	69
PID 3720 wrote to memory of 3920	3720	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f22d49e91603d41e8a8c1c365a4629d79292dcaf39dec17cca0f1bf37eaad5ba_2021-12-01__134422.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f22d49e91603d41e8a8c1c365a4629d79292dcaf39dec17cca0f1bf37eaad5ba_2021-12-01__134422.exe.dll,#1
  2⤵
  PID:3920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 596
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:796