6f67fa640c1f575356ff7c3bf9c58f5a557d300c564a2f221878f03edbb24bc7

Analysis

Target
emotet_exe_e4_6f67fa640c1f575356ff7c3bf9c58f5a557d300c564a2f221878f03edbb24bc7_2021-12-02__064341.exe.dll
Size 462KB
Sample211202-hhhwdsfdc3
SHA256 6f67fa640c1f575356ff7c3bf9c58f5a557d300c564a2f221878f03edbb24bc7
MD5 dff395ee7d2111822de78e8ba9892c5d
SHA1 02d2340bb38fde753271d9fc64ee46d957e6fed8
SHA512 7fc94636151c765a8a67719e78dc10459737e78e8cd3c108bd560c6f90acc65b8191b277063bc23b1a6c693a0c6ba5b0cf835a867b939aeef7ab7ed29f4aaab3
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3964 created 2348	3964	WerFault.exe	68

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2364	2348	WerFault.exe	68
3964	2348	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2348	2272	rundll32.exe	68
PID 2272 wrote to memory of 2348	2272	rundll32.exe	68
PID 2272 wrote to memory of 2348	2272	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6f67fa640c1f575356ff7c3bf9c58f5a557d300c564a2f221878f03edbb24bc7_2021-12-02__064341.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6f67fa640c1f575356ff7c3bf9c58f5a557d300c564a2f221878f03edbb24bc7_2021-12-02__064341.exe.dll,#1
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 624
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 640
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3964