b5e4b36567ff949fd81a2d44063dd59b45309986aae3e7d57a0c71bc4a4fb74a

Analysis

Target
emotet_exe_e5_b5e4b36567ff949fd81a2d44063dd59b45309986aae3e7d57a0c71bc4a4fb74a_2022-01-19__132149.exe.dll
Size 420KB
Sample220119-ql9saaabdk
SHA256 b5e4b36567ff949fd81a2d44063dd59b45309986aae3e7d57a0c71bc4a4fb74a
MD5 e73f5b2480793d929553eccd7bdac808
SHA1 e6fb350917f6a32a80deb247bae99311e701a38c
SHA512 0eef055fc7067b6f8dd5770b29a203562fa48707f1ebe8d8e06d79efd887405931b375396cb31328a0cd880bea0e42124fb5012f8183790087d61a9931ba20c0
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1588	1272	regsvr32.exe	27
PID 1272 wrote to memory of 1588	1272	regsvr32.exe	27
PID 1272 wrote to memory of 1588	1272	regsvr32.exe	27
PID 1272 wrote to memory of 1588	1272	regsvr32.exe	27
PID 1272 wrote to memory of 1588	1272	regsvr32.exe	27
PID 1272 wrote to memory of 1588	1272	regsvr32.exe	27
PID 1272 wrote to memory of 1588	1272	regsvr32.exe	27
PID 1588 wrote to memory of 1360	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1360	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1360	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1360	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1360	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1360	1588	regsvr32.exe	28
PID 1588 wrote to memory of 1360	1588	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b5e4b36567ff949fd81a2d44063dd59b45309986aae3e7d57a0c71bc4a4fb74a_2022-01-19__132149.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b5e4b36567ff949fd81a2d44063dd59b45309986aae3e7d57a0c71bc4a4fb74a_2022-01-19__132149.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_b5e4b36567ff949fd81a2d44063dd59b45309986aae3e7d57a0c71bc4a4fb74a_2022-01-19__132149.exe.dll",DllRegisterServer
    3⤵
    PID:1360

memory/1272-55-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Download

memory/1588-56-0x00000000756C1000-0x00000000756C3000-memory.dmp

Download