c6d93fd65d9dfee9f8ed0b243fbcf68353a54d0a46071c269fc53d6527c5ee6f

Analysis

Target
emotet_exe_e4_c6d93fd65d9dfee9f8ed0b243fbcf68353a54d0a46071c269fc53d6527c5ee6f_2022-01-19__123039.exe.dll
Size 408KB
Sample220119-pp2qeahgak
SHA256 c6d93fd65d9dfee9f8ed0b243fbcf68353a54d0a46071c269fc53d6527c5ee6f
MD5 059f35b70f85c44f367145a209035b9a
SHA1 96dd487486f77039d8b5a2f9b074d68fbd2f15ce
SHA512 773b3bd7c238b1cad48048f43e0ad5cc54e4d247d0d5aca6ef447c74382471f2aebd93fb7604d57268104da23c79f8d9f2c78e93fbe197b3f115fda944bffa5d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 4008	3220	regsvr32.exe	52
PID 3220 wrote to memory of 4008	3220	regsvr32.exe	52
PID 3220 wrote to memory of 4008	3220	regsvr32.exe	52
PID 4008 wrote to memory of 2460	4008	regsvr32.exe	53
PID 4008 wrote to memory of 2460	4008	regsvr32.exe	53
PID 4008 wrote to memory of 2460	4008	regsvr32.exe	53

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_c6d93fd65d9dfee9f8ed0b243fbcf68353a54d0a46071c269fc53d6527c5ee6f_2022-01-19__123039.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_c6d93fd65d9dfee9f8ed0b243fbcf68353a54d0a46071c269fc53d6527c5ee6f_2022-01-19__123039.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_c6d93fd65d9dfee9f8ed0b243fbcf68353a54d0a46071c269fc53d6527c5ee6f_2022-01-19__123039.exe.dll",DllRegisterServer
    3⤵
    PID:2460