29207e465092ac17fd5a1f9c0a04a25b962c2a1a5cbc37e34285fdef4965d4ca

Analysis

Target
emotet_exe_e4_29207e465092ac17fd5a1f9c0a04a25b962c2a1a5cbc37e34285fdef4965d4ca_2021-12-08__000133.exe.dll
Size 215KB
Sample211208-abg2hsdger
SHA256 29207e465092ac17fd5a1f9c0a04a25b962c2a1a5cbc37e34285fdef4965d4ca
MD5 62e8dd4935907b4b583f0c5772a6dc51
SHA1 d183eb10b145f0f71134e9a3776dd9f20be652b7
SHA512 54bed1a315361f61f7ca125190fc1b432ef6ff9da18e5b290f566ff219b581d90889204c19816fef150f062cfb37ad1cadf0b35f519ea67178316cd323c05877
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1668	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1668	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1668	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1668	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1668	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1668	1816	regsvr32.exe	27
PID 1816 wrote to memory of 1668	1816	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_29207e465092ac17fd5a1f9c0a04a25b962c2a1a5cbc37e34285fdef4965d4ca_2021-12-08__000133.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_29207e465092ac17fd5a1f9c0a04a25b962c2a1a5cbc37e34285fdef4965d4ca_2021-12-08__000133.exe.dll
  2⤵
  PID:1668

memory/1668-57-0x0000000075901000-0x0000000075903000-memory.dmp

Download

memory/1816-55-0x000007FEFB8C1000-0x000007FEFB8C3000-memory.dmp

Download