8e246f31ff672a7bd703e86bbc576cf5bbeef6ace3f00142c6f75a709e926387

Analysis

Target
emotet_exe_e5_8e246f31ff672a7bd703e86bbc576cf5bbeef6ace3f00142c6f75a709e926387_2022-01-13__070057.exe.dll
Size 736KB
Sample220113-hs93magch2
SHA256 8e246f31ff672a7bd703e86bbc576cf5bbeef6ace3f00142c6f75a709e926387
MD5 18bb9449d4e55637ba65639f7d26ce7f
SHA1 68d30f1ec51521efe6e9c6622fc4899eee9a3bd4
SHA512 040c171461cbb35ec64112929c0128c04644f03a3ab08b7ff20619e114a464af340a6208b2a45b7b78e1fbe815b24e8513d6fa8250e28b9a3fcc4877a4958070
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1608	744	regsvr32.exe	27
PID 744 wrote to memory of 1608	744	regsvr32.exe	27
PID 744 wrote to memory of 1608	744	regsvr32.exe	27
PID 744 wrote to memory of 1608	744	regsvr32.exe	27
PID 744 wrote to memory of 1608	744	regsvr32.exe	27
PID 744 wrote to memory of 1608	744	regsvr32.exe	27
PID 744 wrote to memory of 1608	744	regsvr32.exe	27
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28
PID 1608 wrote to memory of 652	1608	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8e246f31ff672a7bd703e86bbc576cf5bbeef6ace3f00142c6f75a709e926387_2022-01-13__070057.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8e246f31ff672a7bd703e86bbc576cf5bbeef6ace3f00142c6f75a709e926387_2022-01-13__070057.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8e246f31ff672a7bd703e86bbc576cf5bbeef6ace3f00142c6f75a709e926387_2022-01-13__070057.exe.dll",DllRegisterServer
    3⤵
    PID:652

memory/744-54-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

Download

memory/1608-56-0x00000000763B1000-0x00000000763B3000-memory.dmp

Download

memory/1608-58-0x0000000000225000-0x0000000000226000-memory.dmp

Download

memory/1608-57-0x0000000000201000-0x0000000000225000-memory.dmp

Download