4a783b98209ca5fe2bf4f2ecd683f62dc708a6cdc348b895d40179546962e940

Analysis

Target
emotet_exe_e4_4a783b98209ca5fe2bf4f2ecd683f62dc708a6cdc348b895d40179546962e940_2022-01-12__000549.exe.dll
Size 735KB
Sample220112-adrnqsabf2
SHA256 4a783b98209ca5fe2bf4f2ecd683f62dc708a6cdc348b895d40179546962e940
MD5 5b398f6767692689ce942ceb0eab74ac
SHA1 5cbfc6f9df1ec0e8efd1863f06812493bcd124ca
SHA512 530a69786530e2fd376275f228b909564dd14d0ba68a40983db58fcec9e687f8bab7264c4ae5bdb4446eb2e929078ff880e3a3c596976388450533950dc4d877
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 792	744	regsvr32.exe	27
PID 744 wrote to memory of 792	744	regsvr32.exe	27
PID 744 wrote to memory of 792	744	regsvr32.exe	27
PID 744 wrote to memory of 792	744	regsvr32.exe	27
PID 744 wrote to memory of 792	744	regsvr32.exe	27
PID 744 wrote to memory of 792	744	regsvr32.exe	27
PID 744 wrote to memory of 792	744	regsvr32.exe	27
PID 792 wrote to memory of 964	792	regsvr32.exe	28
PID 792 wrote to memory of 964	792	regsvr32.exe	28
PID 792 wrote to memory of 964	792	regsvr32.exe	28
PID 792 wrote to memory of 964	792	regsvr32.exe	28
PID 792 wrote to memory of 964	792	regsvr32.exe	28
PID 792 wrote to memory of 964	792	regsvr32.exe	28
PID 792 wrote to memory of 964	792	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4a783b98209ca5fe2bf4f2ecd683f62dc708a6cdc348b895d40179546962e940_2022-01-12__000549.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4a783b98209ca5fe2bf4f2ecd683f62dc708a6cdc348b895d40179546962e940_2022-01-12__000549.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4a783b98209ca5fe2bf4f2ecd683f62dc708a6cdc348b895d40179546962e940_2022-01-12__000549.exe.dll",DllRegisterServer
    3⤵
    PID:964

memory/744-54-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Download

memory/792-56-0x0000000075D11000-0x0000000075D13000-memory.dmp

Download

memory/792-58-0x00000000001D3000-0x00000000001D4000-memory.dmp

Download