e1052726d8ea429facfb6fb9b9a16bff6c8a5f6478e05572e8777ffe1b49e2b5

Analysis

Target
emotet_exe_e5_e1052726d8ea429facfb6fb9b9a16bff6c8a5f6478e05572e8777ffe1b49e2b5_2021-12-02__200736.exe.dll
Size 449KB
Sample211202-ywkvxabfck
SHA256 e1052726d8ea429facfb6fb9b9a16bff6c8a5f6478e05572e8777ffe1b49e2b5
MD5 8102461f908c7806f6a73b7a3b981502
SHA1 952e2b5736f57f85e46d132636f86f790f8d123b
SHA512 e83ea90b03440136562c4d2e25ae2e0682a3a2c02566e4130ed92501e8b27c5b6678e33090c8c0779063652d394eec56bb4750014b3cb363f41b79455afe0092
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
640	4036	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 4036	2664	regsvr32.exe	68
PID 2664 wrote to memory of 4036	2664	regsvr32.exe	68
PID 2664 wrote to memory of 4036	2664	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e1052726d8ea429facfb6fb9b9a16bff6c8a5f6478e05572e8777ffe1b49e2b5_2021-12-02__200736.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e1052726d8ea429facfb6fb9b9a16bff6c8a5f6478e05572e8777ffe1b49e2b5_2021-12-02__200736.exe.dll
  2⤵
  PID:4036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 632
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:640