3f23052ede7ff5d573d8daf1fa9574b7b601f0fffa9c0f47cdb2bb4910429e71

Analysis

Target
emotet_exe_e5_3f23052ede7ff5d573d8daf1fa9574b7b601f0fffa9c0f47cdb2bb4910429e71_2022-01-14__171518.exe.dll
Size 574KB
Sample220114-vs799ahdb6
SHA256 3f23052ede7ff5d573d8daf1fa9574b7b601f0fffa9c0f47cdb2bb4910429e71
MD5 518a9993b7619838d25c2961bfaa9ce4
SHA1 ad2435c97b2a40e830421bdfad5e44f01a921628
SHA512 0e92dfaee003e5d841507f7052ff015e52dff3c1c591ef9325305b4cd3744cbd58ceb3c8f625f23c2864d09b262835e3197cc8597a0984f8311faa170bd1eec9
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1620	1660	regsvr32.exe	27
PID 1660 wrote to memory of 1620	1660	regsvr32.exe	27
PID 1660 wrote to memory of 1620	1660	regsvr32.exe	27
PID 1660 wrote to memory of 1620	1660	regsvr32.exe	27
PID 1660 wrote to memory of 1620	1660	regsvr32.exe	27
PID 1660 wrote to memory of 1620	1660	regsvr32.exe	27
PID 1660 wrote to memory of 1620	1660	regsvr32.exe	27
PID 1620 wrote to memory of 1692	1620	regsvr32.exe	28
PID 1620 wrote to memory of 1692	1620	regsvr32.exe	28
PID 1620 wrote to memory of 1692	1620	regsvr32.exe	28
PID 1620 wrote to memory of 1692	1620	regsvr32.exe	28
PID 1620 wrote to memory of 1692	1620	regsvr32.exe	28
PID 1620 wrote to memory of 1692	1620	regsvr32.exe	28
PID 1620 wrote to memory of 1692	1620	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3f23052ede7ff5d573d8daf1fa9574b7b601f0fffa9c0f47cdb2bb4910429e71_2022-01-14__171518.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3f23052ede7ff5d573d8daf1fa9574b7b601f0fffa9c0f47cdb2bb4910429e71_2022-01-14__171518.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3f23052ede7ff5d573d8daf1fa9574b7b601f0fffa9c0f47cdb2bb4910429e71_2022-01-14__171518.exe.dll",DllRegisterServer
    3⤵
    PID:1692

memory/1620-57-0x00000000763F1000-0x00000000763F3000-memory.dmp

Download

memory/1620-59-0x0000000000295000-0x0000000000296000-memory.dmp

Download

memory/1620-58-0x0000000000271000-0x0000000000295000-memory.dmp

Download

memory/1660-55-0x000007FEFC031000-0x000007FEFC033000-memory.dmp

Download