a9b309cf5440d49ed2b427bcfedd7410b5d1e391e009cb4d838aaa8df3791a13

Analysis

Target
emotet_exe_e5_a9b309cf5440d49ed2b427bcfedd7410b5d1e391e009cb4d838aaa8df3791a13_2022-01-15__000447.exe.dll
Size 574KB
Sample220115-ac7cssbdf3
SHA256 a9b309cf5440d49ed2b427bcfedd7410b5d1e391e009cb4d838aaa8df3791a13
MD5 b1707d22247f5691821d984a4b2fb5e2
SHA1 cfecf64f0bcb74625b2adce76f7ea56d97928aa1
SHA512 a045ace167bec01cc01f8d1529902a73f3863322905d3a524aa6cb1fd2219e3aa2468f2108fe4a1d470a35277df556561ff608de2c90bbc913587a5edabe9b17
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 288	952	regsvr32.exe	27
PID 952 wrote to memory of 288	952	regsvr32.exe	27
PID 952 wrote to memory of 288	952	regsvr32.exe	27
PID 952 wrote to memory of 288	952	regsvr32.exe	27
PID 952 wrote to memory of 288	952	regsvr32.exe	27
PID 952 wrote to memory of 288	952	regsvr32.exe	27
PID 952 wrote to memory of 288	952	regsvr32.exe	27
PID 288 wrote to memory of 520	288	regsvr32.exe	28
PID 288 wrote to memory of 520	288	regsvr32.exe	28
PID 288 wrote to memory of 520	288	regsvr32.exe	28
PID 288 wrote to memory of 520	288	regsvr32.exe	28
PID 288 wrote to memory of 520	288	regsvr32.exe	28
PID 288 wrote to memory of 520	288	regsvr32.exe	28
PID 288 wrote to memory of 520	288	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a9b309cf5440d49ed2b427bcfedd7410b5d1e391e009cb4d838aaa8df3791a13_2022-01-15__000447.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a9b309cf5440d49ed2b427bcfedd7410b5d1e391e009cb4d838aaa8df3791a13_2022-01-15__000447.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:288
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a9b309cf5440d49ed2b427bcfedd7410b5d1e391e009cb4d838aaa8df3791a13_2022-01-15__000447.exe.dll",DllRegisterServer
    3⤵
    PID:520

memory/288-56-0x0000000076041000-0x0000000076043000-memory.dmp

Download

memory/288-58-0x00000000008A5000-0x00000000008A6000-memory.dmp

Download

memory/288-57-0x0000000000881000-0x00000000008A5000-memory.dmp

Download

memory/952-54-0x000007FEFB8C1000-0x000007FEFB8C3000-memory.dmp

Download