8e246f31ff672a7bd703e86bbc576cf5bbeef6ace3f00142c6f75a709e926387

Analysis

Target
emotet_exe_e5_8e246f31ff672a7bd703e86bbc576cf5bbeef6ace3f00142c6f75a709e926387_2022-01-13__070057.exe.dll
Size 736KB
Sample220113-hs93magch2
SHA256 8e246f31ff672a7bd703e86bbc576cf5bbeef6ace3f00142c6f75a709e926387
MD5 18bb9449d4e55637ba65639f7d26ce7f
SHA1 68d30f1ec51521efe6e9c6622fc4899eee9a3bd4
SHA512 040c171461cbb35ec64112929c0128c04644f03a3ab08b7ff20619e114a464af340a6208b2a45b7b78e1fbe815b24e8513d6fa8250e28b9a3fcc4877a4958070
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2744	2676	regsvr32.exe	68
PID 2676 wrote to memory of 2744	2676	regsvr32.exe	68
PID 2676 wrote to memory of 2744	2676	regsvr32.exe	68
PID 2744 wrote to memory of 1768	2744	regsvr32.exe	69
PID 2744 wrote to memory of 1768	2744	regsvr32.exe	69
PID 2744 wrote to memory of 1768	2744	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8e246f31ff672a7bd703e86bbc576cf5bbeef6ace3f00142c6f75a709e926387_2022-01-13__070057.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8e246f31ff672a7bd703e86bbc576cf5bbeef6ace3f00142c6f75a709e926387_2022-01-13__070057.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8e246f31ff672a7bd703e86bbc576cf5bbeef6ace3f00142c6f75a709e926387_2022-01-13__070057.exe.dll",DllRegisterServer
    3⤵
    PID:1768

memory/2744-119-0x00000000036E1000-0x0000000003705000-memory.dmp

Download

memory/2744-120-0x0000000003705000-0x0000000003706000-memory.dmp

Download