97bdd86222affc89e7fef7772cb7da6317652d2d0f369866cb1689864170f10f

Analysis

Target
emotet_exe_e5_97bdd86222affc89e7fef7772cb7da6317652d2d0f369866cb1689864170f10f_2022-01-12__000906.exe.dll
Size 745KB
Sample220112-af279aadfl
SHA256 97bdd86222affc89e7fef7772cb7da6317652d2d0f369866cb1689864170f10f
MD5 d0ca3bc1500ce479abf01edb4536d1ba
SHA1 32d5b86ae07a3ba49941e2824f88101bd178e460
SHA512 ffeb1d7b6336982aae9a685c107c3ed9c330224591da64e1238027376cbee284a315a7a01cf79a53b9fd87fe2a31b4d23683f4d3e352b5decc35c8a697e75b5b
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4004	4248	regsvr32.exe	69
PID 4248 wrote to memory of 4004	4248	regsvr32.exe	69
PID 4248 wrote to memory of 4004	4248	regsvr32.exe	69
PID 4004 wrote to memory of 4496	4004	regsvr32.exe	70
PID 4004 wrote to memory of 4496	4004	regsvr32.exe	70
PID 4004 wrote to memory of 4496	4004	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_97bdd86222affc89e7fef7772cb7da6317652d2d0f369866cb1689864170f10f_2022-01-12__000906.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_97bdd86222affc89e7fef7772cb7da6317652d2d0f369866cb1689864170f10f_2022-01-12__000906.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_97bdd86222affc89e7fef7772cb7da6317652d2d0f369866cb1689864170f10f_2022-01-12__000906.exe.dll",DllRegisterServer
    3⤵
    PID:4496

memory/4004-117-0x00000000040F5000-0x00000000040F6000-memory.dmp

Download

memory/4004-116-0x00000000040D1000-0x00000000040F5000-memory.dmp

Download