ebb70dad07c39ae1d7345011b339a5c340436b819635ab947e947e7106700a57

Analysis

Target
emotet_exe_e5_ebb70dad07c39ae1d7345011b339a5c340436b819635ab947e947e7106700a57_2022-01-18__000720.exe.dll
Size 479KB
Sample220118-aexldaecc6
SHA256 ebb70dad07c39ae1d7345011b339a5c340436b819635ab947e947e7106700a57
MD5 a63512037f19d4b22bc3a37e011a5e03
SHA1 ca29c2f9d1d4cda5a0d7681d16673c781fd4786b
SHA512 69f9b520a288834cf6521593b3e3c123410d4d44453a157fd5e3aa814fbc6a152a6dc8b53989cd6de853f0ee6b276d97d0853eb1b79b9b913b543898775eef82
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1616	956	regsvr32.exe	27
PID 956 wrote to memory of 1616	956	regsvr32.exe	27
PID 956 wrote to memory of 1616	956	regsvr32.exe	27
PID 956 wrote to memory of 1616	956	regsvr32.exe	27
PID 956 wrote to memory of 1616	956	regsvr32.exe	27
PID 956 wrote to memory of 1616	956	regsvr32.exe	27
PID 956 wrote to memory of 1616	956	regsvr32.exe	27
PID 1616 wrote to memory of 1096	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1096	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1096	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1096	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1096	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1096	1616	regsvr32.exe	28
PID 1616 wrote to memory of 1096	1616	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ebb70dad07c39ae1d7345011b339a5c340436b819635ab947e947e7106700a57_2022-01-18__000720.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ebb70dad07c39ae1d7345011b339a5c340436b819635ab947e947e7106700a57_2022-01-18__000720.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ebb70dad07c39ae1d7345011b339a5c340436b819635ab947e947e7106700a57_2022-01-18__000720.exe.dll",DllRegisterServer
    3⤵
    PID:1096

memory/956-54-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Download

memory/1616-56-0x0000000075D11000-0x0000000075D13000-memory.dmp

Download

memory/1616-58-0x0000000000285000-0x0000000000286000-memory.dmp

Download

memory/1616-57-0x0000000000261000-0x0000000000285000-memory.dmp

Download