3fb66da7400a65e49a5f2a315d45bf9322dc26e5c9e71103d690e2ed1b25e66b

Analysis

Target
emotet_exe_e4_3fb66da7400a65e49a5f2a315d45bf9322dc26e5c9e71103d690e2ed1b25e66b_2021-12-03__123350.exe.dll
Size 1.1MB
Sample211203-psb9xsbee2
SHA256 3fb66da7400a65e49a5f2a315d45bf9322dc26e5c9e71103d690e2ed1b25e66b
MD5 91103453759a9b2d8e78701032781b1f
SHA1 980f136b169308ae81581ee0eb1a33928b8ee1f8
SHA512 dd96c02f96f2f916ac54f385e8782c5e02fe76ec8d0f28a8b3d513fbc559a4efdee980515932284250403e20169c1e857fc4a552a45f52627caaeb2fdac1da6f
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 772	1268	regsvr32.exe	28
PID 1268 wrote to memory of 772	1268	regsvr32.exe	28
PID 1268 wrote to memory of 772	1268	regsvr32.exe	28
PID 1268 wrote to memory of 772	1268	regsvr32.exe	28
PID 1268 wrote to memory of 772	1268	regsvr32.exe	28
PID 1268 wrote to memory of 772	1268	regsvr32.exe	28
PID 1268 wrote to memory of 772	1268	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3fb66da7400a65e49a5f2a315d45bf9322dc26e5c9e71103d690e2ed1b25e66b_2021-12-03__123350.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3fb66da7400a65e49a5f2a315d45bf9322dc26e5c9e71103d690e2ed1b25e66b_2021-12-03__123350.exe.dll
  2⤵
  PID:772

memory/772-57-0x0000000076241000-0x0000000076243000-memory.dmp

Download

memory/1268-55-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Download