emotet | a34ce563d819c0aa6c881d97fb47d552e40d3b60bf668d4a646f6e566ca5d99d

Analysis

Target
d30c58324ce231b2198be661a2167a38.dll
Size 735KB
Sample220111-1tcgvshef4
SHA256 a34ce563d819c0aa6c881d97fb47d552e40d3b60bf668d4a646f6e566ca5d99d
MD5 d30c58324ce231b2198be661a2167a38
SHA1 a9e6672fb55a96d6860be54e397465557c4b50aa
SHA512 010cc3e40db3d230c5fe66ddcebd8b3833c3080ba7eadb6f87229b983320a2a883d2b40f18a943d4fd90889c6ddac46a69ae2813d1e065a819171a9dfd2ba4f6
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 4016	3896	regsvr32.exe	68
PID 3896 wrote to memory of 4016	3896	regsvr32.exe	68
PID 3896 wrote to memory of 4016	3896	regsvr32.exe	68
PID 4016 wrote to memory of 3156	4016	regsvr32.exe	69
PID 4016 wrote to memory of 3156	4016	regsvr32.exe	69
PID 4016 wrote to memory of 3156	4016	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d30c58324ce231b2198be661a2167a38.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d30c58324ce231b2198be661a2167a38.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\d30c58324ce231b2198be661a2167a38.dll",DllRegisterServer
    3⤵
    PID:3156

memory/4016-117-0x0000000000F33000-0x0000000000F34000-memory.dmp

Download

memory/4016-116-0x0000000000F11000-0x0000000000F33000-memory.dmp

Download