63fd0f9cfd350228d4566626ecbf7a66509b2e13c3c8ae9060b495772639fa46

Analysis

Target
emotet_exe_e5_63fd0f9cfd350228d4566626ecbf7a66509b2e13c3c8ae9060b495772639fa46_2022-01-14__000152.exe.dll
Size 408KB
Sample220114-abkseadcf8
SHA256 63fd0f9cfd350228d4566626ecbf7a66509b2e13c3c8ae9060b495772639fa46
MD5 927b37c439a28e0270e771d608b989ae
SHA1 4d997b12eb05a0c628c701bd526d91680960961b
SHA512 e0e85be05b837234d0b0cfee403c231b8d32802eb50681fa7f7e7280c1078539bac3966a07f97dfa50b57963f0fde6a3bf5acfba94800eafc1fd19751f5a229c
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1312	1656	regsvr32.exe	27
PID 1656 wrote to memory of 1312	1656	regsvr32.exe	27
PID 1656 wrote to memory of 1312	1656	regsvr32.exe	27
PID 1656 wrote to memory of 1312	1656	regsvr32.exe	27
PID 1656 wrote to memory of 1312	1656	regsvr32.exe	27
PID 1656 wrote to memory of 1312	1656	regsvr32.exe	27
PID 1656 wrote to memory of 1312	1656	regsvr32.exe	27
PID 1312 wrote to memory of 1060	1312	regsvr32.exe	28
PID 1312 wrote to memory of 1060	1312	regsvr32.exe	28
PID 1312 wrote to memory of 1060	1312	regsvr32.exe	28
PID 1312 wrote to memory of 1060	1312	regsvr32.exe	28
PID 1312 wrote to memory of 1060	1312	regsvr32.exe	28
PID 1312 wrote to memory of 1060	1312	regsvr32.exe	28
PID 1312 wrote to memory of 1060	1312	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_63fd0f9cfd350228d4566626ecbf7a66509b2e13c3c8ae9060b495772639fa46_2022-01-14__000152.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_63fd0f9cfd350228d4566626ecbf7a66509b2e13c3c8ae9060b495772639fa46_2022-01-14__000152.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_63fd0f9cfd350228d4566626ecbf7a66509b2e13c3c8ae9060b495772639fa46_2022-01-14__000152.exe.dll",DllRegisterServer
    3⤵
    PID:1060

memory/1312-57-0x0000000075801000-0x0000000075803000-memory.dmp

Download

memory/1312-59-0x0000000000215000-0x0000000000216000-memory.dmp

Download

memory/1312-58-0x00000000001F1000-0x0000000000215000-memory.dmp

Download

memory/1656-55-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmp

Download