6f69747084ffd4e3af982816ed90490e822371a3523e0596e70fe0eadb1e9a6e

Analysis

Target
emotet_exe_e5_6f69747084ffd4e3af982816ed90490e822371a3523e0596e70fe0eadb1e9a6e_2022-01-18__000719.exe.dll
Size 469KB
Sample220118-aexalsecb8
SHA256 6f69747084ffd4e3af982816ed90490e822371a3523e0596e70fe0eadb1e9a6e
MD5 51a9fa8a5aca82f9fcbeca87a85cd937
SHA1 b0e55b2ff32d180807a3011ab678e3ec6e24b1e4
SHA512 be116df0c77237ac6ae5d68550d84c830c68372dad4f031004770059294cca86b7510e4ac4d0b5b5dd4b5670f741293074edd7db63269e2b3c4f43d0975aed5d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 528	1560	regsvr32.exe	27
PID 1560 wrote to memory of 528	1560	regsvr32.exe	27
PID 1560 wrote to memory of 528	1560	regsvr32.exe	27
PID 1560 wrote to memory of 528	1560	regsvr32.exe	27
PID 1560 wrote to memory of 528	1560	regsvr32.exe	27
PID 1560 wrote to memory of 528	1560	regsvr32.exe	27
PID 1560 wrote to memory of 528	1560	regsvr32.exe	27
PID 528 wrote to memory of 1248	528	regsvr32.exe	28
PID 528 wrote to memory of 1248	528	regsvr32.exe	28
PID 528 wrote to memory of 1248	528	regsvr32.exe	28
PID 528 wrote to memory of 1248	528	regsvr32.exe	28
PID 528 wrote to memory of 1248	528	regsvr32.exe	28
PID 528 wrote to memory of 1248	528	regsvr32.exe	28
PID 528 wrote to memory of 1248	528	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6f69747084ffd4e3af982816ed90490e822371a3523e0596e70fe0eadb1e9a6e_2022-01-18__000719.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6f69747084ffd4e3af982816ed90490e822371a3523e0596e70fe0eadb1e9a6e_2022-01-18__000719.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:528
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_6f69747084ffd4e3af982816ed90490e822371a3523e0596e70fe0eadb1e9a6e_2022-01-18__000719.exe.dll",DllRegisterServer
    3⤵
    PID:1248

memory/528-56-0x0000000076121000-0x0000000076123000-memory.dmp

Download

memory/528-58-0x0000000000223000-0x0000000000224000-memory.dmp

Download

memory/1560-54-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

Download