6bdc037adfcc07cf56670bb09d6917beb50b70a76d5bad01f9b25bf5e9dadb69

Analysis

Target
emotet_exe_e5_6bdc037adfcc07cf56670bb09d6917beb50b70a76d5bad01f9b25bf5e9dadb69_2022-01-13__221106.exe.dll
Size 408KB
Sample220113-14kwzschcq
SHA256 6bdc037adfcc07cf56670bb09d6917beb50b70a76d5bad01f9b25bf5e9dadb69
MD5 473046e2bd9da993bb873e29ebb5009c
SHA1 4edb91e8e1c1ef8579e0d2bca3b7c3065ae74062
SHA512 3368ca04c6f30a2d6cddf29271db34a1ae2e1f7771f7cba9a99c47f63b9b9a74b18bfb11a7590b06c2482ca0dfa364692559b1a04499c9d3e22f93f5a588b25f
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3416	3628	regsvr32.exe	69
PID 3628 wrote to memory of 3416	3628	regsvr32.exe	69
PID 3628 wrote to memory of 3416	3628	regsvr32.exe	69
PID 3416 wrote to memory of 2576	3416	regsvr32.exe	70
PID 3416 wrote to memory of 2576	3416	regsvr32.exe	70
PID 3416 wrote to memory of 2576	3416	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6bdc037adfcc07cf56670bb09d6917beb50b70a76d5bad01f9b25bf5e9dadb69_2022-01-13__221106.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6bdc037adfcc07cf56670bb09d6917beb50b70a76d5bad01f9b25bf5e9dadb69_2022-01-13__221106.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6bdc037adfcc07cf56670bb09d6917beb50b70a76d5bad01f9b25bf5e9dadb69_2022-01-13__221106.exe.dll",DllRegisterServer
    3⤵
    PID:2576

memory/3416-117-0x0000000002E55000-0x0000000002E56000-memory.dmp

Download