2487fa178b9cfc2b7f49477b3d2b9b26ab1eb098b56bb95989eb44c24b61f4e5

Analysis

Target
emotet_exe_e5_2487fa178b9cfc2b7f49477b3d2b9b26ab1eb098b56bb95989eb44c24b61f4e5_2022-01-14__000153.exe.dll
Size 408KB
Sample220114-abkseaddgj
SHA256 2487fa178b9cfc2b7f49477b3d2b9b26ab1eb098b56bb95989eb44c24b61f4e5
MD5 be99470edcd1df7d009c5d147cc820d7
SHA1 35809aaa40b0f331eed6496a0d26ce6e1b55ca5a
SHA512 afeaeb62c00edb2bf0b47bf1b51933699c4b5346bf7ed594c90dac1e6e85e13c7e06373f3673dee598791c20e430a63a67bcf1cd357f02d8db36c6ff6ea7cd97
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2772	2760	regsvr32.exe	68
PID 2760 wrote to memory of 2772	2760	regsvr32.exe	68
PID 2760 wrote to memory of 2772	2760	regsvr32.exe	68
PID 2772 wrote to memory of 428	2772	regsvr32.exe	69
PID 2772 wrote to memory of 428	2772	regsvr32.exe	69
PID 2772 wrote to memory of 428	2772	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2487fa178b9cfc2b7f49477b3d2b9b26ab1eb098b56bb95989eb44c24b61f4e5_2022-01-14__000153.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2487fa178b9cfc2b7f49477b3d2b9b26ab1eb098b56bb95989eb44c24b61f4e5_2022-01-14__000153.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2487fa178b9cfc2b7f49477b3d2b9b26ab1eb098b56bb95989eb44c24b61f4e5_2022-01-14__000153.exe.dll",DllRegisterServer
    3⤵
    PID:428

memory/2772-117-0x00000000009C5000-0x00000000009C6000-memory.dmp

Download

memory/2772-116-0x00000000009A1000-0x00000000009C5000-memory.dmp

Download