3f23052ede7ff5d573d8daf1fa9574b7b601f0fffa9c0f47cdb2bb4910429e71

Analysis

Target
emotet_exe_e5_3f23052ede7ff5d573d8daf1fa9574b7b601f0fffa9c0f47cdb2bb4910429e71_2022-01-14__171518.exe.dll
Size 574KB
Sample220114-vs799ahdb6
SHA256 3f23052ede7ff5d573d8daf1fa9574b7b601f0fffa9c0f47cdb2bb4910429e71
MD5 518a9993b7619838d25c2961bfaa9ce4
SHA1 ad2435c97b2a40e830421bdfad5e44f01a921628
SHA512 0e92dfaee003e5d841507f7052ff015e52dff3c1c591ef9325305b4cd3744cbd58ceb3c8f625f23c2864d09b262835e3197cc8597a0984f8311faa170bd1eec9
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1672	1444	regsvr32.exe	54
PID 1444 wrote to memory of 1672	1444	regsvr32.exe	54
PID 1444 wrote to memory of 1672	1444	regsvr32.exe	54
PID 1672 wrote to memory of 2732	1672	regsvr32.exe	55
PID 1672 wrote to memory of 2732	1672	regsvr32.exe	55
PID 1672 wrote to memory of 2732	1672	regsvr32.exe	55

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3f23052ede7ff5d573d8daf1fa9574b7b601f0fffa9c0f47cdb2bb4910429e71_2022-01-14__171518.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3f23052ede7ff5d573d8daf1fa9574b7b601f0fffa9c0f47cdb2bb4910429e71_2022-01-14__171518.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3f23052ede7ff5d573d8daf1fa9574b7b601f0fffa9c0f47cdb2bb4910429e71_2022-01-14__171518.exe.dll",DllRegisterServer
    3⤵
    PID:2732

memory/1672-132-0x0000000002E25000-0x0000000002E26000-memory.dmp

Download

memory/1672-131-0x0000000002E01000-0x0000000002E25000-memory.dmp

Download