e9cfe47ad9df7fa1a116b96998d77ec5611f82b2a67f8c1ba6ecf124eecb05ff

Analysis

Target
emotet_exe_e5_e9cfe47ad9df7fa1a116b96998d77ec5611f82b2a67f8c1ba6ecf124eecb05ff_2022-01-18__000720.exe.dll
Size 479KB
Sample220118-aexldaefep
SHA256 e9cfe47ad9df7fa1a116b96998d77ec5611f82b2a67f8c1ba6ecf124eecb05ff
MD5 373ca21b55123f0dc3e264f978852f8f
SHA1 a48d2089f7b313f0976c8623c807b2e3247ea4d1
SHA512 63b203c515bb93e00cb611e0e667a140f6d4576fdda7aefd675c85c31ef42ce36fb8cd539abacb0b861a2f0f3d5085fad5c5e3b3eedb2e6827343236e5f7b093
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1612	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1612	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1612	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1612	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1612	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1612	1636	regsvr32.exe	27
PID 1636 wrote to memory of 1612	1636	regsvr32.exe	27
PID 1612 wrote to memory of 520	1612	regsvr32.exe	28
PID 1612 wrote to memory of 520	1612	regsvr32.exe	28
PID 1612 wrote to memory of 520	1612	regsvr32.exe	28
PID 1612 wrote to memory of 520	1612	regsvr32.exe	28
PID 1612 wrote to memory of 520	1612	regsvr32.exe	28
PID 1612 wrote to memory of 520	1612	regsvr32.exe	28
PID 1612 wrote to memory of 520	1612	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e9cfe47ad9df7fa1a116b96998d77ec5611f82b2a67f8c1ba6ecf124eecb05ff_2022-01-18__000720.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e9cfe47ad9df7fa1a116b96998d77ec5611f82b2a67f8c1ba6ecf124eecb05ff_2022-01-18__000720.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e9cfe47ad9df7fa1a116b96998d77ec5611f82b2a67f8c1ba6ecf124eecb05ff_2022-01-18__000720.exe.dll",DllRegisterServer
    3⤵
    PID:520

memory/1612-56-0x0000000076921000-0x0000000076923000-memory.dmp

Download

memory/1612-58-0x00000000003D5000-0x00000000003D6000-memory.dmp

Download

memory/1636-54-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Download