755f467b9abd46942c73cf2cd8618dda09393c14a41733153be4bffaa33d5a1d

Analysis

Target
emotet_exe_e4_755f467b9abd46942c73cf2cd8618dda09393c14a41733153be4bffaa33d5a1d_2021-12-04__000220.exe.dll
Size 1.1MB
Sample211204-ab22pacea8
SHA256 755f467b9abd46942c73cf2cd8618dda09393c14a41733153be4bffaa33d5a1d
MD5 6ca6b94e94271f07977224b6500f0bb2
SHA1 72cdd61a08f2606db0290e0140f5b192f6e265cd
SHA512 0aef899caada90eeb291ddab10611eca233e0065569a6647681444cba761cba4711d64c8e8e4902f9bccf0326077861748c3e9fa1995e71d157fc81d3941c2d6
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 652	864	regsvr32.exe	28
PID 864 wrote to memory of 652	864	regsvr32.exe	28
PID 864 wrote to memory of 652	864	regsvr32.exe	28
PID 864 wrote to memory of 652	864	regsvr32.exe	28
PID 864 wrote to memory of 652	864	regsvr32.exe	28
PID 864 wrote to memory of 652	864	regsvr32.exe	28
PID 864 wrote to memory of 652	864	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_755f467b9abd46942c73cf2cd8618dda09393c14a41733153be4bffaa33d5a1d_2021-12-04__000220.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_755f467b9abd46942c73cf2cd8618dda09393c14a41733153be4bffaa33d5a1d_2021-12-04__000220.exe.dll
  2⤵
  PID:652

memory/652-57-0x0000000076171000-0x0000000076173000-memory.dmp

Download

memory/864-55-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Download