0e6fd5cacab6b4cbb2ada3ff96bc8274f8e4aa9a9bbf32877c9a8a0feed6b2a7

Analysis

Target
emotet_exe_e5_0e6fd5cacab6b4cbb2ada3ff96bc8274f8e4aa9a9bbf32877c9a8a0feed6b2a7_2022-01-13__165249.exe.dll
Size 1.4MB
Sample220113-vd1xmabfd2
SHA256 0e6fd5cacab6b4cbb2ada3ff96bc8274f8e4aa9a9bbf32877c9a8a0feed6b2a7
MD5 d379379f41bec78ae8ecfff223ede114
SHA1 8510b90fe84a9b446688e72ee4735188997fe063
SHA512 62e86667d43664ec753dafe1e3945f37e014ee42cd361b06ff2907fd26b7d6f95c0ec5ea9d5ef4215844f7eae3015d0369c9f94657b9a9629f86082755587819
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 744	740	regsvr32.exe	27
PID 740 wrote to memory of 744	740	regsvr32.exe	27
PID 740 wrote to memory of 744	740	regsvr32.exe	27
PID 740 wrote to memory of 744	740	regsvr32.exe	27
PID 740 wrote to memory of 744	740	regsvr32.exe	27
PID 740 wrote to memory of 744	740	regsvr32.exe	27
PID 740 wrote to memory of 744	740	regsvr32.exe	27
PID 744 wrote to memory of 1648	744	regsvr32.exe	28
PID 744 wrote to memory of 1648	744	regsvr32.exe	28
PID 744 wrote to memory of 1648	744	regsvr32.exe	28
PID 744 wrote to memory of 1648	744	regsvr32.exe	28
PID 744 wrote to memory of 1648	744	regsvr32.exe	28
PID 744 wrote to memory of 1648	744	regsvr32.exe	28
PID 744 wrote to memory of 1648	744	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0e6fd5cacab6b4cbb2ada3ff96bc8274f8e4aa9a9bbf32877c9a8a0feed6b2a7_2022-01-13__165249.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0e6fd5cacab6b4cbb2ada3ff96bc8274f8e4aa9a9bbf32877c9a8a0feed6b2a7_2022-01-13__165249.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0e6fd5cacab6b4cbb2ada3ff96bc8274f8e4aa9a9bbf32877c9a8a0feed6b2a7_2022-01-13__165249.exe.dll",DllRegisterServer
    3⤵
    PID:1648

memory/740-55-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

Download

memory/744-57-0x00000000763B1000-0x00000000763B3000-memory.dmp

Download

memory/744-60-0x00000000001B0000-0x00000000001D8000-memory.dmp

Download