4f7a5eaa42dba78a09bd044c4ab90715072a1e65387d99097c316e9efe2d3ddb

Analysis

Target
emotet_exe_e5_4f7a5eaa42dba78a09bd044c4ab90715072a1e65387d99097c316e9efe2d3ddb_2022-01-12__000906.exe.dll
Size 745KB
Sample220112-af279aadfk
SHA256 4f7a5eaa42dba78a09bd044c4ab90715072a1e65387d99097c316e9efe2d3ddb
MD5 5c30d51f8c76ac2fff1fb11eb10a87db
SHA1 baa0bce85b16be9c5fb86955e0bedff2dd885f5c
SHA512 97a7c42349f6654445a9f42b2be2c3a5f1e0875c918b1240ee3355204d35a0b66ad40a0e122d9aaff2e0af8e5e98ea2f63ebf6628f5b923877bba9db4fee1009
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1608	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1608	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1608	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1608	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1608	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1608	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1608	1684	regsvr32.exe	27
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4f7a5eaa42dba78a09bd044c4ab90715072a1e65387d99097c316e9efe2d3ddb_2022-01-12__000906.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4f7a5eaa42dba78a09bd044c4ab90715072a1e65387d99097c316e9efe2d3ddb_2022-01-12__000906.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4f7a5eaa42dba78a09bd044c4ab90715072a1e65387d99097c316e9efe2d3ddb_2022-01-12__000906.exe.dll",DllRegisterServer
    3⤵
    PID:652

memory/1608-56-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/1608-58-0x0000000000245000-0x0000000000246000-memory.dmp

Download

memory/1608-57-0x0000000000221000-0x0000000000245000-memory.dmp

Download

memory/1684-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Download