b5a07a8f4183bdcbea25886e349de47f798a1903b4326aa9e0944ac73d643c0a

Analysis

Target
emotet_exe_e5_b5a07a8f4183bdcbea25886e349de47f798a1903b4326aa9e0944ac73d643c0a_2022-01-14__000151.exe.dll
Size 408KB
Sample220114-abkgmsddfm
SHA256 b5a07a8f4183bdcbea25886e349de47f798a1903b4326aa9e0944ac73d643c0a
MD5 b8beb4cb2d17b1ae936e1838a00a4520
SHA1 ca88900eca9852ad241f56d6f1e0dd40a22dea0b
SHA512 61fa4145b9c4d7345957d61b1a169b5e2dd1fdc859fae35434542e91ed51e6ee3097f07f8b5e525ef2760faf1e8be95423dd98a792607d98f4754c8e649f7779
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 592	1364	regsvr32.exe	27
PID 1364 wrote to memory of 592	1364	regsvr32.exe	27
PID 1364 wrote to memory of 592	1364	regsvr32.exe	27
PID 1364 wrote to memory of 592	1364	regsvr32.exe	27
PID 1364 wrote to memory of 592	1364	regsvr32.exe	27
PID 1364 wrote to memory of 592	1364	regsvr32.exe	27
PID 1364 wrote to memory of 592	1364	regsvr32.exe	27
PID 592 wrote to memory of 744	592	regsvr32.exe	28
PID 592 wrote to memory of 744	592	regsvr32.exe	28
PID 592 wrote to memory of 744	592	regsvr32.exe	28
PID 592 wrote to memory of 744	592	regsvr32.exe	28
PID 592 wrote to memory of 744	592	regsvr32.exe	28
PID 592 wrote to memory of 744	592	regsvr32.exe	28
PID 592 wrote to memory of 744	592	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b5a07a8f4183bdcbea25886e349de47f798a1903b4326aa9e0944ac73d643c0a_2022-01-14__000151.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b5a07a8f4183bdcbea25886e349de47f798a1903b4326aa9e0944ac73d643c0a_2022-01-14__000151.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:592
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b5a07a8f4183bdcbea25886e349de47f798a1903b4326aa9e0944ac73d643c0a_2022-01-14__000151.exe.dll",DllRegisterServer
    3⤵
    PID:744

memory/592-56-0x00000000766D1000-0x00000000766D3000-memory.dmp

Download

memory/592-58-0x00000000001F5000-0x00000000001F6000-memory.dmp

Download

memory/592-57-0x00000000001D1000-0x00000000001F5000-memory.dmp

Download

memory/1364-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download