09bc0629aeae9f3a8cfb06a0eb0abae9597b1a861dd0c576d052c1f772f7cc6f

Analysis

Target
emotet_exe_e5_09bc0629aeae9f3a8cfb06a0eb0abae9597b1a861dd0c576d052c1f772f7cc6f_2021-12-02__155101.exe.dll
Size 456KB
Sample211202-ta3flsacar
SHA256 09bc0629aeae9f3a8cfb06a0eb0abae9597b1a861dd0c576d052c1f772f7cc6f
MD5 15b729408f20e92035f707b3a6718863
SHA1 70fe9914f792d1828d38d07f841594a56cb39e72
SHA512 907daff42618a373fba2d70f5153c919d3530ade767486ec86bab828d79d4cc72c7daa6bcceef1c676e882c745c78fded088569bcff55cfb2a39e75aa975a2b7
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3924 created 3588	3924	WerFault.exe	68

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3592	3588	WerFault.exe	68
3924	3588	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3588	3716	rundll32.exe	68
PID 3716 wrote to memory of 3588	3716	rundll32.exe	68
PID 3716 wrote to memory of 3588	3716	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_09bc0629aeae9f3a8cfb06a0eb0abae9597b1a861dd0c576d052c1f772f7cc6f_2021-12-02__155101.exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_09bc0629aeae9f3a8cfb06a0eb0abae9597b1a861dd0c576d052c1f772f7cc6f_2021-12-02__155101.exe.dll,#1
  2⤵
  PID:3588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 608
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 620
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3924