62b5a5bec91df3b90bc22eed0c8cc6f333e887febef021b1321ca63ddf37335c

Analysis

Target
emotet_exe_e5_62b5a5bec91df3b90bc22eed0c8cc6f333e887febef021b1321ca63ddf37335c_2022-01-13__000954.exe.dll
Size 470KB
Sample220113-af4q3sege4
SHA256 62b5a5bec91df3b90bc22eed0c8cc6f333e887febef021b1321ca63ddf37335c
MD5 d44c98cc1b7d4d0e00ca73765aa60f4e
SHA1 637a04b5821a1a95cc03f524f3ea801fb1cf3b11
SHA512 7e4ca5b57bf7c94db1c3d4f666cdecced1e871202c9a11ece30b6e2a0a3e69d5cfe42a06522e909b662abd083f64449bee893eb810fe78245f4d67b8fbc7140d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4064	4236	regsvr32.exe	68
PID 4236 wrote to memory of 4064	4236	regsvr32.exe	68
PID 4236 wrote to memory of 4064	4236	regsvr32.exe	68
PID 4064 wrote to memory of 4452	4064	regsvr32.exe	71
PID 4064 wrote to memory of 4452	4064	regsvr32.exe	71
PID 4064 wrote to memory of 4452	4064	regsvr32.exe	71

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_62b5a5bec91df3b90bc22eed0c8cc6f333e887febef021b1321ca63ddf37335c_2022-01-13__000954.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_62b5a5bec91df3b90bc22eed0c8cc6f333e887febef021b1321ca63ddf37335c_2022-01-13__000954.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_62b5a5bec91df3b90bc22eed0c8cc6f333e887febef021b1321ca63ddf37335c_2022-01-13__000954.exe.dll",DllRegisterServer
    3⤵
    PID:4452

memory/4064-120-0x0000000000C20000-0x0000000000C49000-memory.dmp

Download