0e6fd5cacab6b4cbb2ada3ff96bc8274f8e4aa9a9bbf32877c9a8a0feed6b2a7

Analysis

Target
emotet_exe_e5_0e6fd5cacab6b4cbb2ada3ff96bc8274f8e4aa9a9bbf32877c9a8a0feed6b2a7_2022-01-13__165249.exe.dll
Size 1.4MB
Sample220113-vd1xmabfd2
SHA256 0e6fd5cacab6b4cbb2ada3ff96bc8274f8e4aa9a9bbf32877c9a8a0feed6b2a7
MD5 d379379f41bec78ae8ecfff223ede114
SHA1 8510b90fe84a9b446688e72ee4735188997fe063
SHA512 62e86667d43664ec753dafe1e3945f37e014ee42cd361b06ff2907fd26b7d6f95c0ec5ea9d5ef4215844f7eae3015d0369c9f94657b9a9629f86082755587819
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2736	2608	regsvr32.exe	68
PID 2608 wrote to memory of 2736	2608	regsvr32.exe	68
PID 2608 wrote to memory of 2736	2608	regsvr32.exe	68
PID 2736 wrote to memory of 3828	2736	regsvr32.exe	69
PID 2736 wrote to memory of 3828	2736	regsvr32.exe	69
PID 2736 wrote to memory of 3828	2736	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0e6fd5cacab6b4cbb2ada3ff96bc8274f8e4aa9a9bbf32877c9a8a0feed6b2a7_2022-01-13__165249.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0e6fd5cacab6b4cbb2ada3ff96bc8274f8e4aa9a9bbf32877c9a8a0feed6b2a7_2022-01-13__165249.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0e6fd5cacab6b4cbb2ada3ff96bc8274f8e4aa9a9bbf32877c9a8a0feed6b2a7_2022-01-13__165249.exe.dll",DllRegisterServer
    3⤵
    PID:3828

memory/2736-120-0x0000000000D80000-0x0000000000DA8000-memory.dmp

Download