5207dda3f4017757489d6cb863883029aa31d8b0138fc2af6143bb2bef22a2ce

Analysis

Target
#Emotet_n14.bin.dll
Size 267KB
Sample211201-shb3ysdbfr
SHA256 5207dda3f4017757489d6cb863883029aa31d8b0138fc2af6143bb2bef22a2ce
MD5 6178b0a6feb3d59055ec39ecfe5f2de1
SHA1 f620b3801d039ed637554112b8a37631d154f7c4
SHA512 d195aea061d78e653749283ac2d66541e9fe447167671effbdb0a0025544c8b5b3e54c8b02624864f65962d22440357fa9ce99e3de15af10851f47775bb3eb1f
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4060	2684	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2684	2440	rundll32.exe	68
PID 2440 wrote to memory of 2684	2440	rundll32.exe	68
PID 2440 wrote to memory of 2684	2440	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\#Emotet_n14.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\#Emotet_n14.bin.dll,#1
  2⤵
  PID:2684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 584
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4060