535f35132dace2798aa0fff7443ba187629862d439e83b584f165ff66f46ba7d

Analysis

Target
emotet_exe_e5_535f35132dace2798aa0fff7443ba187629862d439e83b584f165ff66f46ba7d_2022-01-18__000720.exe.dll
Size 479KB
Sample220118-aexalsecb7
SHA256 535f35132dace2798aa0fff7443ba187629862d439e83b584f165ff66f46ba7d
MD5 920182e2f31baa8219c33e125510432e
SHA1 dc30afb09e71fc5d59d20d5d15a633aec5265f7c
SHA512 a7d72dd821c50c8abdfecac8ebacee47f6b127662127b0915b3b3d09b1e1e2418b1cc57a9c7bf7b6f5a2b0a743153b42fcb2187d9b34b930b0b2f04dcb59675e
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 964	1260	regsvr32.exe	27
PID 1260 wrote to memory of 964	1260	regsvr32.exe	27
PID 1260 wrote to memory of 964	1260	regsvr32.exe	27
PID 1260 wrote to memory of 964	1260	regsvr32.exe	27
PID 1260 wrote to memory of 964	1260	regsvr32.exe	27
PID 1260 wrote to memory of 964	1260	regsvr32.exe	27
PID 1260 wrote to memory of 964	1260	regsvr32.exe	27
PID 964 wrote to memory of 368	964	regsvr32.exe	28
PID 964 wrote to memory of 368	964	regsvr32.exe	28
PID 964 wrote to memory of 368	964	regsvr32.exe	28
PID 964 wrote to memory of 368	964	regsvr32.exe	28
PID 964 wrote to memory of 368	964	regsvr32.exe	28
PID 964 wrote to memory of 368	964	regsvr32.exe	28
PID 964 wrote to memory of 368	964	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_535f35132dace2798aa0fff7443ba187629862d439e83b584f165ff66f46ba7d_2022-01-18__000720.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_535f35132dace2798aa0fff7443ba187629862d439e83b584f165ff66f46ba7d_2022-01-18__000720.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_535f35132dace2798aa0fff7443ba187629862d439e83b584f165ff66f46ba7d_2022-01-18__000720.exe.dll",DllRegisterServer
    3⤵
    PID:368

memory/964-56-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download

memory/964-58-0x00000000003B5000-0x00000000003B6000-memory.dmp

Download

memory/964-57-0x0000000000391000-0x00000000003B5000-memory.dmp

Download

memory/1260-54-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

Download