63fd0f9cfd350228d4566626ecbf7a66509b2e13c3c8ae9060b495772639fa46

Analysis

Target
emotet_exe_e5_63fd0f9cfd350228d4566626ecbf7a66509b2e13c3c8ae9060b495772639fa46_2022-01-14__000152.exe.dll
Size 408KB
Sample220114-abkseadcf8
SHA256 63fd0f9cfd350228d4566626ecbf7a66509b2e13c3c8ae9060b495772639fa46
MD5 927b37c439a28e0270e771d608b989ae
SHA1 4d997b12eb05a0c628c701bd526d91680960961b
SHA512 e0e85be05b837234d0b0cfee403c231b8d32802eb50681fa7f7e7280c1078539bac3966a07f97dfa50b57963f0fde6a3bf5acfba94800eafc1fd19751f5a229c
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2668	2664	regsvr32.exe	68
PID 2664 wrote to memory of 2668	2664	regsvr32.exe	68
PID 2664 wrote to memory of 2668	2664	regsvr32.exe	68
PID 2668 wrote to memory of 2760	2668	regsvr32.exe	69
PID 2668 wrote to memory of 2760	2668	regsvr32.exe	69
PID 2668 wrote to memory of 2760	2668	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_63fd0f9cfd350228d4566626ecbf7a66509b2e13c3c8ae9060b495772639fa46_2022-01-14__000152.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_63fd0f9cfd350228d4566626ecbf7a66509b2e13c3c8ae9060b495772639fa46_2022-01-14__000152.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_63fd0f9cfd350228d4566626ecbf7a66509b2e13c3c8ae9060b495772639fa46_2022-01-14__000152.exe.dll",DllRegisterServer
    3⤵
    PID:2760

memory/2668-120-0x0000000003605000-0x0000000003606000-memory.dmp

Download

memory/2668-119-0x00000000035E1000-0x0000000003605000-memory.dmp

Download