fb5a71768751a471ca7e4e006aa1b5a1f195a065342ccdb1cdab470bbc398328

Analysis

Target
emotet_exe_e5_fb5a71768751a471ca7e4e006aa1b5a1f195a065342ccdb1cdab470bbc398328_2022-01-13__070057.exe.dll
Size 736KB
Sample220113-hs93magddl
SHA256 fb5a71768751a471ca7e4e006aa1b5a1f195a065342ccdb1cdab470bbc398328
MD5 7e80119a509f66f756c36fa6df229388
SHA1 7f2e2b5c6e51a9a9a2fba08160b92d54cbcedc74
SHA512 1ab7eb88fc016a026b8163365c963aaca6de4f088ffc679597644a3f72c0fa930c8055c128bd7485d1f5a82a8816132db222c4fb14adce5b717497a8906c6f34
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2420	2384	regsvr32.exe	68
PID 2384 wrote to memory of 2420	2384	regsvr32.exe	68
PID 2384 wrote to memory of 2420	2384	regsvr32.exe	68
PID 2420 wrote to memory of 2676	2420	regsvr32.exe	69
PID 2420 wrote to memory of 2676	2420	regsvr32.exe	69
PID 2420 wrote to memory of 2676	2420	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_fb5a71768751a471ca7e4e006aa1b5a1f195a065342ccdb1cdab470bbc398328_2022-01-13__070057.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_fb5a71768751a471ca7e4e006aa1b5a1f195a065342ccdb1cdab470bbc398328_2022-01-13__070057.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_fb5a71768751a471ca7e4e006aa1b5a1f195a065342ccdb1cdab470bbc398328_2022-01-13__070057.exe.dll",DllRegisterServer
    3⤵
    PID:2676

memory/2420-117-0x0000000003555000-0x0000000003556000-memory.dmp

Download

memory/2420-116-0x0000000003531000-0x0000000003555000-memory.dmp

Download