44e794ce2fce48b1a19e879e78ac60cf8d269dcb3036694085af0bbea209cc16

Analysis

Target
emotet_exe_e5_44e794ce2fce48b1a19e879e78ac60cf8d269dcb3036694085af0bbea209cc16_2022-01-13__221104.exe.dll
Size 408KB
Sample220113-14kwzschcp
SHA256 44e794ce2fce48b1a19e879e78ac60cf8d269dcb3036694085af0bbea209cc16
MD5 347c4b6331a1871595ce48d6a5624ad0
SHA1 65d55b774e592a22b24ba30607427b48da730b08
SHA512 8053ee09829426511b9a734ea1d9acb2fdadcadc2a2ee408ca7119f5b9ccf5cbe608e7a6c09f77c4b4ce58570014f960a052c6c381ad3e5c855ac311faaddc25
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 732	736	regsvr32.exe	69
PID 736 wrote to memory of 732	736	regsvr32.exe	69
PID 736 wrote to memory of 732	736	regsvr32.exe	69
PID 732 wrote to memory of 1356	732	regsvr32.exe	70
PID 732 wrote to memory of 1356	732	regsvr32.exe	70
PID 732 wrote to memory of 1356	732	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_44e794ce2fce48b1a19e879e78ac60cf8d269dcb3036694085af0bbea209cc16_2022-01-13__221104.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_44e794ce2fce48b1a19e879e78ac60cf8d269dcb3036694085af0bbea209cc16_2022-01-13__221104.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:732
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_44e794ce2fce48b1a19e879e78ac60cf8d269dcb3036694085af0bbea209cc16_2022-01-13__221104.exe.dll",DllRegisterServer
    3⤵
    PID:1356

memory/732-117-0x0000000000B05000-0x0000000000B06000-memory.dmp

Download

memory/732-116-0x0000000000AE1000-0x0000000000B05000-memory.dmp

Download