97bdd86222affc89e7fef7772cb7da6317652d2d0f369866cb1689864170f10f

Analysis

Target
emotet_exe_e5_97bdd86222affc89e7fef7772cb7da6317652d2d0f369866cb1689864170f10f_2022-01-12__000906.exe.dll
Size 745KB
Sample220112-af279aadfl
SHA256 97bdd86222affc89e7fef7772cb7da6317652d2d0f369866cb1689864170f10f
MD5 d0ca3bc1500ce479abf01edb4536d1ba
SHA1 32d5b86ae07a3ba49941e2824f88101bd178e460
SHA512 ffeb1d7b6336982aae9a685c107c3ed9c330224591da64e1238027376cbee284a315a7a01cf79a53b9fd87fe2a31b4d23683f4d3e352b5decc35c8a697e75b5b
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1480	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1480	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1480	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1480	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1480	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1480	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1480	1684	regsvr32.exe	27
PID 1480 wrote to memory of 880	1480	regsvr32.exe	28
PID 1480 wrote to memory of 880	1480	regsvr32.exe	28
PID 1480 wrote to memory of 880	1480	regsvr32.exe	28
PID 1480 wrote to memory of 880	1480	regsvr32.exe	28
PID 1480 wrote to memory of 880	1480	regsvr32.exe	28
PID 1480 wrote to memory of 880	1480	regsvr32.exe	28
PID 1480 wrote to memory of 880	1480	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_97bdd86222affc89e7fef7772cb7da6317652d2d0f369866cb1689864170f10f_2022-01-12__000906.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_97bdd86222affc89e7fef7772cb7da6317652d2d0f369866cb1689864170f10f_2022-01-12__000906.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_97bdd86222affc89e7fef7772cb7da6317652d2d0f369866cb1689864170f10f_2022-01-12__000906.exe.dll",DllRegisterServer
    3⤵
    PID:880

memory/1480-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Download

memory/1480-57-0x00000000002F5000-0x00000000002F6000-memory.dmp

Download

memory/1480-56-0x00000000002D1000-0x00000000002F5000-memory.dmp

Download

memory/1684-53-0x000007FEFC501000-0x000007FEFC503000-memory.dmp

Download