a9b309cf5440d49ed2b427bcfedd7410b5d1e391e009cb4d838aaa8df3791a13

Analysis

Target
emotet_exe_e5_a9b309cf5440d49ed2b427bcfedd7410b5d1e391e009cb4d838aaa8df3791a13_2022-01-15__000447.exe.dll
Size 574KB
Sample220115-ac7cssbdf3
SHA256 a9b309cf5440d49ed2b427bcfedd7410b5d1e391e009cb4d838aaa8df3791a13
MD5 b1707d22247f5691821d984a4b2fb5e2
SHA1 cfecf64f0bcb74625b2adce76f7ea56d97928aa1
SHA512 a045ace167bec01cc01f8d1529902a73f3863322905d3a524aa6cb1fd2219e3aa2468f2108fe4a1d470a35277df556561ff608de2c90bbc913587a5edabe9b17
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 720	3596	regsvr32.exe	53
PID 3596 wrote to memory of 720	3596	regsvr32.exe	53
PID 3596 wrote to memory of 720	3596	regsvr32.exe	53
PID 720 wrote to memory of 1920	720	regsvr32.exe	55
PID 720 wrote to memory of 1920	720	regsvr32.exe	55
PID 720 wrote to memory of 1920	720	regsvr32.exe	55

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a9b309cf5440d49ed2b427bcfedd7410b5d1e391e009cb4d838aaa8df3791a13_2022-01-15__000447.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a9b309cf5440d49ed2b427bcfedd7410b5d1e391e009cb4d838aaa8df3791a13_2022-01-15__000447.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a9b309cf5440d49ed2b427bcfedd7410b5d1e391e009cb4d838aaa8df3791a13_2022-01-15__000447.exe.dll",DllRegisterServer
    3⤵
    PID:1920

memory/720-132-0x0000000004985000-0x0000000004986000-memory.dmp

Download

memory/720-131-0x0000000004961000-0x0000000004985000-memory.dmp

Download