a42b19809d5c72e4bfb1f3c32db4ddd2c000b9e85d84fe34de06dbd658f186e9

Analysis

Target
emotet_exe_e5_a42b19809d5c72e4bfb1f3c32db4ddd2c000b9e85d84fe34de06dbd658f186e9_2021-12-01__134423.exe.dll
Size 267KB
Sample211201-q2dpsaffc2
SHA256 a42b19809d5c72e4bfb1f3c32db4ddd2c000b9e85d84fe34de06dbd658f186e9
MD5 71c766c4b31dc3fa5f23385a9ce6787c
SHA1 5c9c0859e7fb649b8abc935e1264072261c839d5
SHA512 8bf30b55da0ca4a54448c3f180eeb23d81f0901d214520f00cae44c4b483cfd34a8b5966e0a7ab24bb84e28836e9584a7878e0b240bdbcdaaaebfc1b028d44a9
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	3772	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 3772	3184	rundll32.exe	68
PID 3184 wrote to memory of 3772	3184	rundll32.exe	68
PID 3184 wrote to memory of 3772	3184	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a42b19809d5c72e4bfb1f3c32db4ddd2c000b9e85d84fe34de06dbd658f186e9_2021-12-01__134423.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a42b19809d5c72e4bfb1f3c32db4ddd2c000b9e85d84fe34de06dbd658f186e9_2021-12-01__134423.exe.dll,#1
  2⤵
  PID:3772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 584
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2372