00f1537b13933762e1146e41f3bac668123fac7eacd0aa1f7be0aa37a91ef3ce

Analysis

Target
emotet_exe_e4_00f1537b13933762e1146e41f3bac668123fac7eacd0aa1f7be0aa37a91ef3ce_2021-12-02__064345.exe.dll
Size 462KB
Sample211202-hhhwdsfdc4
SHA256 00f1537b13933762e1146e41f3bac668123fac7eacd0aa1f7be0aa37a91ef3ce
MD5 7e2be7e8985a5bdbbde869c9f78d6a48
SHA1 06f929a8223687c230b9321a2d06b9cb7ff00229
SHA512 0645af1b0026614ef2036fd6e670a0c9aa8028d9a1f4f1e611fc5eb50e509a5ca1ae09d2173cf7fadba7fba6ecdf6bb606a9ea7a90ccd5c413ca9c96e0d768cf
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3940 created 3032	3940	WerFault.exe	69

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1548	3032	WerFault.exe	69
3940	3032	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 3032	2756	rundll32.exe	69
PID 2756 wrote to memory of 3032	2756	rundll32.exe	69
PID 2756 wrote to memory of 3032	2756	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_00f1537b13933762e1146e41f3bac668123fac7eacd0aa1f7be0aa37a91ef3ce_2021-12-02__064345.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_00f1537b13933762e1146e41f3bac668123fac7eacd0aa1f7be0aa37a91ef3ce_2021-12-02__064345.exe.dll,#1
  2⤵
  PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 616
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 636
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3940