48bd5955509a3749f4d5f97232ebfab874451d4e5abef410c1d853fd30a03e75

Analysis

Target
emotet_exe_e5_48bd5955509a3749f4d5f97232ebfab874451d4e5abef410c1d853fd30a03e75_2022-01-14__000152.exe.dll
Size 408KB
Sample220114-abkseaddfr
SHA256 48bd5955509a3749f4d5f97232ebfab874451d4e5abef410c1d853fd30a03e75
MD5 1d4994cbb708ea0b75274ce007f0c65c
SHA1 8639a7018e8b713e124625f5055685d40a28e43f
SHA512 c5beb19b8569ff2a99d871de8e91c9a1dff8e4a8a7224fe3bc2b22e36224a0544fd060b6aeab86a1f151bf9211836b372c52f566c78888a61b12c667a68dc4d5
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3716	2924	regsvr32.exe	69
PID 2924 wrote to memory of 3716	2924	regsvr32.exe	69
PID 2924 wrote to memory of 3716	2924	regsvr32.exe	69
PID 3716 wrote to memory of 3452	3716	regsvr32.exe	70
PID 3716 wrote to memory of 3452	3716	regsvr32.exe	70
PID 3716 wrote to memory of 3452	3716	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_48bd5955509a3749f4d5f97232ebfab874451d4e5abef410c1d853fd30a03e75_2022-01-14__000152.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_48bd5955509a3749f4d5f97232ebfab874451d4e5abef410c1d853fd30a03e75_2022-01-14__000152.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_48bd5955509a3749f4d5f97232ebfab874451d4e5abef410c1d853fd30a03e75_2022-01-14__000152.exe.dll",DllRegisterServer
    3⤵
    PID:3452

memory/3716-120-0x0000000000AE5000-0x0000000000AE6000-memory.dmp

Download

memory/3716-119-0x0000000000AC1000-0x0000000000AE5000-memory.dmp

Download