f33e01b368ae6683dc8e954d589dfabd0d42212446d20c0af4433cdcaf40ef74

Analysis

Target
emotet_exe_e5_f33e01b368ae6683dc8e954d589dfabd0d42212446d20c0af4433cdcaf40ef74_2022-01-18__000718.exe.dll
Size 479KB
Sample220118-aexalsecb6
SHA256 f33e01b368ae6683dc8e954d589dfabd0d42212446d20c0af4433cdcaf40ef74
MD5 78ebaa8574e0a6f0a99c116a8a15fa25
SHA1 864e3680b8578a89adbb261726006356f3ea2585
SHA512 8419878e17b6bd2fe653c77a2e05b274b23d46e559d5651cdba1c4c46e946d8c0439123f82c355ebd96752989b712f8701a11daeff0af3cd5e6d2a05636c7422
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 960	1684	regsvr32.exe	27
PID 1684 wrote to memory of 960	1684	regsvr32.exe	27
PID 1684 wrote to memory of 960	1684	regsvr32.exe	27
PID 1684 wrote to memory of 960	1684	regsvr32.exe	27
PID 1684 wrote to memory of 960	1684	regsvr32.exe	27
PID 1684 wrote to memory of 960	1684	regsvr32.exe	27
PID 1684 wrote to memory of 960	1684	regsvr32.exe	27
PID 960 wrote to memory of 368	960	regsvr32.exe	28
PID 960 wrote to memory of 368	960	regsvr32.exe	28
PID 960 wrote to memory of 368	960	regsvr32.exe	28
PID 960 wrote to memory of 368	960	regsvr32.exe	28
PID 960 wrote to memory of 368	960	regsvr32.exe	28
PID 960 wrote to memory of 368	960	regsvr32.exe	28
PID 960 wrote to memory of 368	960	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f33e01b368ae6683dc8e954d589dfabd0d42212446d20c0af4433cdcaf40ef74_2022-01-18__000718.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f33e01b368ae6683dc8e954d589dfabd0d42212446d20c0af4433cdcaf40ef74_2022-01-18__000718.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_f33e01b368ae6683dc8e954d589dfabd0d42212446d20c0af4433cdcaf40ef74_2022-01-18__000718.exe.dll",DllRegisterServer
    3⤵
    PID:368

memory/960-56-0x0000000075761000-0x0000000075763000-memory.dmp

Download

memory/960-58-0x00000000001D5000-0x00000000001D6000-memory.dmp

Download

memory/960-57-0x00000000001B1000-0x00000000001D5000-memory.dmp

Download

memory/1684-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download