4f7a5eaa42dba78a09bd044c4ab90715072a1e65387d99097c316e9efe2d3ddb

Analysis

Target
emotet_exe_e5_4f7a5eaa42dba78a09bd044c4ab90715072a1e65387d99097c316e9efe2d3ddb_2022-01-12__000906.exe.dll
Size 745KB
Sample220112-af279aadfk
SHA256 4f7a5eaa42dba78a09bd044c4ab90715072a1e65387d99097c316e9efe2d3ddb
MD5 5c30d51f8c76ac2fff1fb11eb10a87db
SHA1 baa0bce85b16be9c5fb86955e0bedff2dd885f5c
SHA512 97a7c42349f6654445a9f42b2be2c3a5f1e0875c918b1240ee3355204d35a0b66ad40a0e122d9aaff2e0af8e5e98ea2f63ebf6628f5b923877bba9db4fee1009
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 3840	3664	regsvr32.exe	69
PID 3664 wrote to memory of 3840	3664	regsvr32.exe	69
PID 3664 wrote to memory of 3840	3664	regsvr32.exe	69
PID 3840 wrote to memory of 3016	3840	regsvr32.exe	70
PID 3840 wrote to memory of 3016	3840	regsvr32.exe	70
PID 3840 wrote to memory of 3016	3840	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4f7a5eaa42dba78a09bd044c4ab90715072a1e65387d99097c316e9efe2d3ddb_2022-01-12__000906.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4f7a5eaa42dba78a09bd044c4ab90715072a1e65387d99097c316e9efe2d3ddb_2022-01-12__000906.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4f7a5eaa42dba78a09bd044c4ab90715072a1e65387d99097c316e9efe2d3ddb_2022-01-12__000906.exe.dll",DllRegisterServer
    3⤵
    PID:3016

memory/3840-117-0x0000000004215000-0x0000000004216000-memory.dmp

Download

memory/3840-116-0x00000000041F1000-0x0000000004215000-memory.dmp

Download