48bd5955509a3749f4d5f97232ebfab874451d4e5abef410c1d853fd30a03e75

Analysis

Target
emotet_exe_e5_48bd5955509a3749f4d5f97232ebfab874451d4e5abef410c1d853fd30a03e75_2022-01-14__000152.exe.dll
Size 408KB
Sample220114-abkseaddfr
SHA256 48bd5955509a3749f4d5f97232ebfab874451d4e5abef410c1d853fd30a03e75
MD5 1d4994cbb708ea0b75274ce007f0c65c
SHA1 8639a7018e8b713e124625f5055685d40a28e43f
SHA512 c5beb19b8569ff2a99d871de8e91c9a1dff8e4a8a7224fe3bc2b22e36224a0544fd060b6aeab86a1f151bf9211836b372c52f566c78888a61b12c667a68dc4d5
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1136	1148	regsvr32.exe	27
PID 1148 wrote to memory of 1136	1148	regsvr32.exe	27
PID 1148 wrote to memory of 1136	1148	regsvr32.exe	27
PID 1148 wrote to memory of 1136	1148	regsvr32.exe	27
PID 1148 wrote to memory of 1136	1148	regsvr32.exe	27
PID 1148 wrote to memory of 1136	1148	regsvr32.exe	27
PID 1148 wrote to memory of 1136	1148	regsvr32.exe	27
PID 1136 wrote to memory of 968	1136	regsvr32.exe	28
PID 1136 wrote to memory of 968	1136	regsvr32.exe	28
PID 1136 wrote to memory of 968	1136	regsvr32.exe	28
PID 1136 wrote to memory of 968	1136	regsvr32.exe	28
PID 1136 wrote to memory of 968	1136	regsvr32.exe	28
PID 1136 wrote to memory of 968	1136	regsvr32.exe	28
PID 1136 wrote to memory of 968	1136	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_48bd5955509a3749f4d5f97232ebfab874451d4e5abef410c1d853fd30a03e75_2022-01-14__000152.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_48bd5955509a3749f4d5f97232ebfab874451d4e5abef410c1d853fd30a03e75_2022-01-14__000152.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_48bd5955509a3749f4d5f97232ebfab874451d4e5abef410c1d853fd30a03e75_2022-01-14__000152.exe.dll",DllRegisterServer
    3⤵
    PID:968

memory/1136-57-0x0000000076511000-0x0000000076513000-memory.dmp

Download

memory/1136-59-0x0000000000555000-0x0000000000556000-memory.dmp

Download

memory/1136-58-0x0000000000531000-0x0000000000555000-memory.dmp

Download

memory/1148-55-0x000007FEFC151000-0x000007FEFC153000-memory.dmp

Download