b5a07a8f4183bdcbea25886e349de47f798a1903b4326aa9e0944ac73d643c0a

Analysis

Target
emotet_exe_e5_b5a07a8f4183bdcbea25886e349de47f798a1903b4326aa9e0944ac73d643c0a_2022-01-14__000151.exe.dll
Size 408KB
Sample220114-abkgmsddfm
SHA256 b5a07a8f4183bdcbea25886e349de47f798a1903b4326aa9e0944ac73d643c0a
MD5 b8beb4cb2d17b1ae936e1838a00a4520
SHA1 ca88900eca9852ad241f56d6f1e0dd40a22dea0b
SHA512 61fa4145b9c4d7345957d61b1a169b5e2dd1fdc859fae35434542e91ed51e6ee3097f07f8b5e525ef2760faf1e8be95423dd98a792607d98f4754c8e649f7779
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2200	3992	regsvr32.exe	69
PID 3992 wrote to memory of 2200	3992	regsvr32.exe	69
PID 3992 wrote to memory of 2200	3992	regsvr32.exe	69
PID 2200 wrote to memory of 2280	2200	regsvr32.exe	70
PID 2200 wrote to memory of 2280	2200	regsvr32.exe	70
PID 2200 wrote to memory of 2280	2200	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b5a07a8f4183bdcbea25886e349de47f798a1903b4326aa9e0944ac73d643c0a_2022-01-14__000151.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b5a07a8f4183bdcbea25886e349de47f798a1903b4326aa9e0944ac73d643c0a_2022-01-14__000151.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b5a07a8f4183bdcbea25886e349de47f798a1903b4326aa9e0944ac73d643c0a_2022-01-14__000151.exe.dll",DllRegisterServer
    3⤵
    PID:2280

memory/2200-120-0x00000000031C5000-0x00000000031C6000-memory.dmp

Download