c4e8f0dc2c8147a3161edd6cc29334c2a201ab21bc214438c1940cfece1b9e69

Analysis

Target
emotet_exe_e5_c4e8f0dc2c8147a3161edd6cc29334c2a201ab21bc214438c1940cfece1b9e69_2022-01-14__000153.exe.dll
Size 408KB
Sample220114-abkseaddfp
SHA256 c4e8f0dc2c8147a3161edd6cc29334c2a201ab21bc214438c1940cfece1b9e69
MD5 642f9069ef3b6e81fcc3e1f716304b3f
SHA1 18f78ff5362453d76bed4bc0615e370a0abe24b9
SHA512 66065e4993c4ba75a89ee5a89c5268fd19973309b1767c603902f1dc086072fd5ce819c0b29ce1a783d5d26389bb24e9b3991a1aa576c541cc07b595531f8941
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 948	1780	regsvr32.exe	27
PID 1780 wrote to memory of 948	1780	regsvr32.exe	27
PID 1780 wrote to memory of 948	1780	regsvr32.exe	27
PID 1780 wrote to memory of 948	1780	regsvr32.exe	27
PID 1780 wrote to memory of 948	1780	regsvr32.exe	27
PID 1780 wrote to memory of 948	1780	regsvr32.exe	27
PID 1780 wrote to memory of 948	1780	regsvr32.exe	27
PID 948 wrote to memory of 1252	948	regsvr32.exe	28
PID 948 wrote to memory of 1252	948	regsvr32.exe	28
PID 948 wrote to memory of 1252	948	regsvr32.exe	28
PID 948 wrote to memory of 1252	948	regsvr32.exe	28
PID 948 wrote to memory of 1252	948	regsvr32.exe	28
PID 948 wrote to memory of 1252	948	regsvr32.exe	28
PID 948 wrote to memory of 1252	948	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c4e8f0dc2c8147a3161edd6cc29334c2a201ab21bc214438c1940cfece1b9e69_2022-01-14__000153.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c4e8f0dc2c8147a3161edd6cc29334c2a201ab21bc214438c1940cfece1b9e69_2022-01-14__000153.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c4e8f0dc2c8147a3161edd6cc29334c2a201ab21bc214438c1940cfece1b9e69_2022-01-14__000153.exe.dll",DllRegisterServer
    3⤵
    PID:1252

memory/948-57-0x0000000075F91000-0x0000000075F93000-memory.dmp

Download

memory/948-59-0x0000000000895000-0x0000000000896000-memory.dmp

Download

memory/948-58-0x0000000000871000-0x0000000000895000-memory.dmp

Download

memory/1780-55-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Download