emotet | d8ecf3ebd94bbd006f0979e7d8f94eedf4d3c3e895bc35fc65e5fc81e198c7d3

Analysis

Target
9e42a9d5827b2ce10e1ed541600a5de0.dll
Size 735KB
Sample220111-1zhaashfb4
SHA256 d8ecf3ebd94bbd006f0979e7d8f94eedf4d3c3e895bc35fc65e5fc81e198c7d3
MD5 9e42a9d5827b2ce10e1ed541600a5de0
SHA1 4c59670c1d31b4bebe8d70a8a7e4ba1e091b6458
SHA512 e03fe45c011b84533f469533e1987941dcf52f2fcd16ac31c332abf9cd0de38f236ec46b6ce226f387f256fc8d496453df8e78c5a51c7686e16f2afd43c7910e
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 2656	3204	regsvr32.exe	68
PID 3204 wrote to memory of 2656	3204	regsvr32.exe	68
PID 3204 wrote to memory of 2656	3204	regsvr32.exe	68
PID 2656 wrote to memory of 2756	2656	regsvr32.exe	69
PID 2656 wrote to memory of 2756	2656	regsvr32.exe	69
PID 2656 wrote to memory of 2756	2656	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9e42a9d5827b2ce10e1ed541600a5de0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\9e42a9d5827b2ce10e1ed541600a5de0.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\9e42a9d5827b2ce10e1ed541600a5de0.dll",DllRegisterServer
    3⤵
    PID:2756

memory/2656-117-0x0000000000C93000-0x0000000000C94000-memory.dmp

Download

memory/2656-116-0x0000000000C71000-0x0000000000C93000-memory.dmp

Download