28e0d6f6bba0889582f1a052d21b1ac07f59022749b531ea11003de527488903

Analysis

Target
emotet_exe_e5_28e0d6f6bba0889582f1a052d21b1ac07f59022749b531ea11003de527488903_2022-01-15__000449.exe.dll
Size 574KB
Sample220115-ac87dsbdf9
SHA256 28e0d6f6bba0889582f1a052d21b1ac07f59022749b531ea11003de527488903
MD5 0e80c8f19a6a615d333d7e99b1a93fd6
SHA1 4b0ed49355d0d55a49a68b18b8326e0bf9c76db8
SHA512 a79891f45535e1aa4dcdada99b397296453ae8896f6544cca6e7423952960c37c3bfeb64a05b67a1f68f5cc038da16390ddea3c3c8afcef873444d434142e86d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1632 wrote to memory of 1668	1632	regsvr32.exe	27
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28
PID 1668 wrote to memory of 472	1668	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_28e0d6f6bba0889582f1a052d21b1ac07f59022749b531ea11003de527488903_2022-01-15__000449.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_28e0d6f6bba0889582f1a052d21b1ac07f59022749b531ea11003de527488903_2022-01-15__000449.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_28e0d6f6bba0889582f1a052d21b1ac07f59022749b531ea11003de527488903_2022-01-15__000449.exe.dll",DllRegisterServer
    3⤵
    PID:472

memory/1632-55-0x000007FEFC0E1000-0x000007FEFC0E3000-memory.dmp

Download

memory/1668-57-0x0000000076141000-0x0000000076143000-memory.dmp

Download

memory/1668-59-0x0000000000305000-0x0000000000306000-memory.dmp

Download

memory/1668-58-0x00000000002E1000-0x0000000000305000-memory.dmp

Download