d239fa608efc8b42efdce551b3c3a631ecec86b916804f1355f497788e59a8b0

Analysis

Target
emotet_exe_e5_d239fa608efc8b42efdce551b3c3a631ecec86b916804f1355f497788e59a8b0_2022-01-13__070057.exe.dll
Size 736KB
Sample220113-htsvqsgdek
SHA256 d239fa608efc8b42efdce551b3c3a631ecec86b916804f1355f497788e59a8b0
MD5 9c0876fed6df28286d64e107504f4eb6
SHA1 6fc10a3297e9f479f51196f1bb9736bfe6d04252
SHA512 c9665a0e519ff684b2e366a6d32571f5f84fd528e8a1b1faa4025a7df5e56c386814c94bbcbb3cca29b5d190b970e093c7d7115624cebe6f537b6a7f0876f678
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2512	2360	regsvr32.exe	68
PID 2360 wrote to memory of 2512	2360	regsvr32.exe	68
PID 2360 wrote to memory of 2512	2360	regsvr32.exe	68
PID 2512 wrote to memory of 2776	2512	regsvr32.exe	69
PID 2512 wrote to memory of 2776	2512	regsvr32.exe	69
PID 2512 wrote to memory of 2776	2512	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d239fa608efc8b42efdce551b3c3a631ecec86b916804f1355f497788e59a8b0_2022-01-13__070057.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d239fa608efc8b42efdce551b3c3a631ecec86b916804f1355f497788e59a8b0_2022-01-13__070057.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d239fa608efc8b42efdce551b3c3a631ecec86b916804f1355f497788e59a8b0_2022-01-13__070057.exe.dll",DllRegisterServer
    3⤵
    PID:2776

memory/2512-120-0x0000000004B15000-0x0000000004B16000-memory.dmp

Download

memory/2512-119-0x0000000004AF1000-0x0000000004B15000-memory.dmp

Download