c4e8f0dc2c8147a3161edd6cc29334c2a201ab21bc214438c1940cfece1b9e69

Analysis

Target
emotet_exe_e5_c4e8f0dc2c8147a3161edd6cc29334c2a201ab21bc214438c1940cfece1b9e69_2022-01-14__000153.exe.dll
Size 408KB
Sample220114-abkseaddfp
SHA256 c4e8f0dc2c8147a3161edd6cc29334c2a201ab21bc214438c1940cfece1b9e69
MD5 642f9069ef3b6e81fcc3e1f716304b3f
SHA1 18f78ff5362453d76bed4bc0615e370a0abe24b9
SHA512 66065e4993c4ba75a89ee5a89c5268fd19973309b1767c603902f1dc086072fd5ce819c0b29ce1a783d5d26389bb24e9b3991a1aa576c541cc07b595531f8941
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2564	2560	regsvr32.exe	68
PID 2560 wrote to memory of 2564	2560	regsvr32.exe	68
PID 2560 wrote to memory of 2564	2560	regsvr32.exe	68
PID 2564 wrote to memory of 2836	2564	regsvr32.exe	69
PID 2564 wrote to memory of 2836	2564	regsvr32.exe	69
PID 2564 wrote to memory of 2836	2564	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c4e8f0dc2c8147a3161edd6cc29334c2a201ab21bc214438c1940cfece1b9e69_2022-01-14__000153.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c4e8f0dc2c8147a3161edd6cc29334c2a201ab21bc214438c1940cfece1b9e69_2022-01-14__000153.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_c4e8f0dc2c8147a3161edd6cc29334c2a201ab21bc214438c1940cfece1b9e69_2022-01-14__000153.exe.dll",DllRegisterServer
    3⤵
    PID:2836

memory/2564-120-0x00000000029B5000-0x00000000029B6000-memory.dmp

Download

memory/2564-119-0x0000000002991000-0x00000000029B5000-memory.dmp

Download