73f3bf4a298865bfff2f9dfe980ae472f8464c50dfe8e3d85a0b121362ca6c5c

Analysis

Target
emotet_exe_e5_73f3bf4a298865bfff2f9dfe980ae472f8464c50dfe8e3d85a0b121362ca6c5c_2022-01-18__000721.exe.dll
Size 479KB
Sample220118-aexldaefeq
SHA256 73f3bf4a298865bfff2f9dfe980ae472f8464c50dfe8e3d85a0b121362ca6c5c
MD5 c810f55b95c2c8386e2a9333391dc49d
SHA1 0347877f99f380808861dcf16b95afd972372dcf
SHA512 cb9f3ca180b84c9a6c6f490d92b19c453f642e82b2bf929e8f3497f392dddf058cd8489f2502472b703033928c7302b17d5f9cdcc793e51a594ebd6afe65743a
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 956 wrote to memory of 516	956	regsvr32.exe	27
PID 516 wrote to memory of 820	516	regsvr32.exe	28
PID 516 wrote to memory of 820	516	regsvr32.exe	28
PID 516 wrote to memory of 820	516	regsvr32.exe	28
PID 516 wrote to memory of 820	516	regsvr32.exe	28
PID 516 wrote to memory of 820	516	regsvr32.exe	28
PID 516 wrote to memory of 820	516	regsvr32.exe	28
PID 516 wrote to memory of 820	516	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_73f3bf4a298865bfff2f9dfe980ae472f8464c50dfe8e3d85a0b121362ca6c5c_2022-01-18__000721.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_73f3bf4a298865bfff2f9dfe980ae472f8464c50dfe8e3d85a0b121362ca6c5c_2022-01-18__000721.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_73f3bf4a298865bfff2f9dfe980ae472f8464c50dfe8e3d85a0b121362ca6c5c_2022-01-18__000721.exe.dll",DllRegisterServer
    3⤵
    PID:820

memory/516-56-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/516-58-0x0000000000205000-0x0000000000206000-memory.dmp

Download

memory/516-57-0x00000000001E1000-0x0000000000205000-memory.dmp

Download

memory/956-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download