29207e465092ac17fd5a1f9c0a04a25b962c2a1a5cbc37e34285fdef4965d4ca

Analysis

Target
emotet_exe_e4_29207e465092ac17fd5a1f9c0a04a25b962c2a1a5cbc37e34285fdef4965d4ca_2021-12-08__000133.exe.dll
Size 215KB
Sample211208-abg2hsdger
SHA256 29207e465092ac17fd5a1f9c0a04a25b962c2a1a5cbc37e34285fdef4965d4ca
MD5 62e8dd4935907b4b583f0c5772a6dc51
SHA1 d183eb10b145f0f71134e9a3776dd9f20be652b7
SHA512 54bed1a315361f61f7ca125190fc1b432ef6ff9da18e5b290f566ff219b581d90889204c19816fef150f062cfb37ad1cadf0b35f519ea67178316cd323c05877
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
592	3296	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 3296	4088	regsvr32.exe	69
PID 4088 wrote to memory of 3296	4088	regsvr32.exe	69
PID 4088 wrote to memory of 3296	4088	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_29207e465092ac17fd5a1f9c0a04a25b962c2a1a5cbc37e34285fdef4965d4ca_2021-12-08__000133.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_29207e465092ac17fd5a1f9c0a04a25b962c2a1a5cbc37e34285fdef4965d4ca_2021-12-08__000133.exe.dll
  2⤵
  PID:3296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 608
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:592