a18e30a25e70d8d342c67a5a1f2823f2d6fd8d2de843170e7e0526817814884d

Analysis

Target
emotet_exe_e5_a18e30a25e70d8d342c67a5a1f2823f2d6fd8d2de843170e7e0526817814884d_2022-01-13__221105.exe.dll
Size 408KB
Sample220113-14k7rachdk
SHA256 a18e30a25e70d8d342c67a5a1f2823f2d6fd8d2de843170e7e0526817814884d
MD5 a677137b594e0722ae734e3dfe912535
SHA1 aa8e43c3c28127ac581b20ed203ee2df3b106192
SHA512 95c378617dfa08aacec8a70aeefa46d05ef7d6d92ac8b833e6c90c105bd44934be903ff07d9d3b8b5430983a481ccb35cf24373d5d5f6acdc2111a0b66e24ee2
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 3520	3064	regsvr32.exe	69
PID 3064 wrote to memory of 3520	3064	regsvr32.exe	69
PID 3064 wrote to memory of 3520	3064	regsvr32.exe	69
PID 3520 wrote to memory of 3844	3520	regsvr32.exe	70
PID 3520 wrote to memory of 3844	3520	regsvr32.exe	70
PID 3520 wrote to memory of 3844	3520	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a18e30a25e70d8d342c67a5a1f2823f2d6fd8d2de843170e7e0526817814884d_2022-01-13__221105.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a18e30a25e70d8d342c67a5a1f2823f2d6fd8d2de843170e7e0526817814884d_2022-01-13__221105.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a18e30a25e70d8d342c67a5a1f2823f2d6fd8d2de843170e7e0526817814884d_2022-01-13__221105.exe.dll",DllRegisterServer
    3⤵
    PID:3844

memory/3520-120-0x0000000000F85000-0x0000000000F86000-memory.dmp

Download