4a601fa054e1d414797c53a76b933d90cb2d1e09bd95429c5659d5e97c156635

Analysis

Target
emotet_exe_e5_4a601fa054e1d414797c53a76b933d90cb2d1e09bd95429c5659d5e97c156635_2022-01-14__000152.exe.dll
Size 408KB
Sample220114-abkgmsddfn
SHA256 4a601fa054e1d414797c53a76b933d90cb2d1e09bd95429c5659d5e97c156635
MD5 e80b477ecca2d65d9db684fd8012b2a6
SHA1 80538926d6b45a69ebc51d344c2cb74571be4963
SHA512 e30ce4f7dd2c558afe39484408f312513d18d289409e8ed94bd61f2238f03455df03231fc3db6b0a4f45f43ed6283d902d1d8fc5f9da550a428dd5dff26bb049
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2772	2740	regsvr32.exe	68
PID 2740 wrote to memory of 2772	2740	regsvr32.exe	68
PID 2740 wrote to memory of 2772	2740	regsvr32.exe	68
PID 2772 wrote to memory of 3508	2772	regsvr32.exe	69
PID 2772 wrote to memory of 3508	2772	regsvr32.exe	69
PID 2772 wrote to memory of 3508	2772	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4a601fa054e1d414797c53a76b933d90cb2d1e09bd95429c5659d5e97c156635_2022-01-14__000152.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4a601fa054e1d414797c53a76b933d90cb2d1e09bd95429c5659d5e97c156635_2022-01-14__000152.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4a601fa054e1d414797c53a76b933d90cb2d1e09bd95429c5659d5e97c156635_2022-01-14__000152.exe.dll",DllRegisterServer
    3⤵
    PID:3508

memory/2772-120-0x0000000003005000-0x0000000003006000-memory.dmp

Download