d66ab3d6d153c3a9bea2e6fbd6a9ebeb7865a7c7e69a7e5175f4af70f9c14bf4

Analysis

Target
#Emotet_n13.bin.dll
Size 267KB
Sample211201-shb3ysdbfq
SHA256 d66ab3d6d153c3a9bea2e6fbd6a9ebeb7865a7c7e69a7e5175f4af70f9c14bf4
MD5 2dd248ce2fca1499c6117cf8cdcb521a
SHA1 80890955244cab074a160529c4bd71ba6de672d0
SHA512 549e5882bd74ff7230ed5c473ec592b1c07ab4f474e5525cfca9ee4c8639212df4487ae00f95350d3104246d67391cbc512d3a33a00c3bd766af98fedf6dcad6
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	2732	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2732	2720	rundll32.exe	68
PID 2720 wrote to memory of 2732	2720	rundll32.exe	68
PID 2720 wrote to memory of 2732	2720	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\#Emotet_n13.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\#Emotet_n13.bin.dll,#1
  2⤵
  PID:2732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 584
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2760