4b142b8e259a5154172c46abef8d37fea57ddd9c9bea8bc0d208043205f8cc9e

Analysis

Target
emotet_exe_e4_4b142b8e259a5154172c46abef8d37fea57ddd9c9bea8bc0d208043205f8cc9e_2022-01-19__000642.exe.dll
Size 398KB
Sample220119-aey47sebc5
SHA256 4b142b8e259a5154172c46abef8d37fea57ddd9c9bea8bc0d208043205f8cc9e
MD5 71d7766fe884d312f8e55de4df4b6020
SHA1 52cdb81f7a4f532bacc742b0587e8f1c3432457d
SHA512 6d1926163111f9e27c81c819af938aba0561d46a892481f0ff0b559cd0301a8f3e979ae476163088879b62957615eabb4ec6bdcab004ba780302c8282fef9c8b
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	628	svchost.exe
Token: SeSystemtimePrivilege	628	svchost.exe
Token: SeIncBasePriorityPrivilege	628	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3580	3004	regsvr32.exe	51
PID 3004 wrote to memory of 3580	3004	regsvr32.exe	51
PID 3004 wrote to memory of 3580	3004	regsvr32.exe	51
PID 3580 wrote to memory of 1800	3580	regsvr32.exe	52
PID 3580 wrote to memory of 1800	3580	regsvr32.exe	52
PID 3580 wrote to memory of 1800	3580	regsvr32.exe	52

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4b142b8e259a5154172c46abef8d37fea57ddd9c9bea8bc0d208043205f8cc9e_2022-01-19__000642.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4b142b8e259a5154172c46abef8d37fea57ddd9c9bea8bc0d208043205f8cc9e_2022-01-19__000642.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4b142b8e259a5154172c46abef8d37fea57ddd9c9bea8bc0d208043205f8cc9e_2022-01-19__000642.exe.dll",DllRegisterServer
    3⤵
    PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:628