c88513832f2edac55b7b44d16ff672a1c546c2f203ac93afbc121cbd063dce46

Analysis

Target
emotet_exe_e5_c88513832f2edac55b7b44d16ff672a1c546c2f203ac93afbc121cbd063dce46_2021-12-02__155059.exe.dll
Size 456KB
Sample211202-ta25vaacaq
SHA256 c88513832f2edac55b7b44d16ff672a1c546c2f203ac93afbc121cbd063dce46
MD5 45e6d21bcc86d8139925c8a6bf1096b0
SHA1 b87ec3ff988851e98f6dbc2b214406eaddea1bec
SHA512 002fcb04d9193adcd04419229abf00a20f20837b855bf1107f29698bc9286716ab14f164e02e7fa4f95c059d7e5057944d449a9e417fe895835e0a7b3e0cc9d9
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4476 created 3564	4476	WerFault.exe	68

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4412	3564	WerFault.exe	68
4476	3564	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 3564	3552	rundll32.exe	68
PID 3552 wrote to memory of 3564	3552	rundll32.exe	68
PID 3552 wrote to memory of 3564	3552	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c88513832f2edac55b7b44d16ff672a1c546c2f203ac93afbc121cbd063dce46_2021-12-02__155059.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c88513832f2edac55b7b44d16ff672a1c546c2f203ac93afbc121cbd063dce46_2021-12-02__155059.exe.dll,#1
  2⤵
  PID:3564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 616
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 636
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4476