234f3a72171c24af642fd551625c78991d32e195d52cc4cdbe9ccaed9f0c4b0e

Analysis

Target
emotet_exe_e5_234f3a72171c24af642fd551625c78991d32e195d52cc4cdbe9ccaed9f0c4b0e_2021-12-03__000307.exe.dll
Size 449KB
Sample211203-acqeaachfp
SHA256 234f3a72171c24af642fd551625c78991d32e195d52cc4cdbe9ccaed9f0c4b0e
MD5 95f8fb03508c4d645ff130fc8cd63ffe
SHA1 c8c27fe8cc51704d97dd1752b14bf5ddc2b0b170
SHA512 7ee8d943118bbccf63a27132671e220dffa4b7738368161339d1bb06d70b90c1a9f8eb2735f8d21490dee240a9cf1be91c4969636b1a8d0ed91d93ab6407fe54
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3584	1676	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 1676	2724	regsvr32.exe	68
PID 2724 wrote to memory of 1676	2724	regsvr32.exe	68
PID 2724 wrote to memory of 1676	2724	regsvr32.exe	68

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_234f3a72171c24af642fd551625c78991d32e195d52cc4cdbe9ccaed9f0c4b0e_2021-12-03__000307.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_234f3a72171c24af642fd551625c78991d32e195d52cc4cdbe9ccaed9f0c4b0e_2021-12-03__000307.exe.dll
  2⤵
  PID:1676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 632
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3584