ebe2c558b147c2dfacd35abd30be084ab507f9c4a88104e191eaf769adbfa75a

Analysis

Target
emotet_exe_e5_ebe2c558b147c2dfacd35abd30be084ab507f9c4a88104e191eaf769adbfa75a_2022-01-19__150107.exe.dll
Size 602KB
Sample220119-sefxqsahcm
SHA256 ebe2c558b147c2dfacd35abd30be084ab507f9c4a88104e191eaf769adbfa75a
MD5 2de682ad58c3525fd332ee64f120e643
SHA1 4f89512104da767d66a450b98f54da949b12be39
SHA512 7b31c7823f3fa7b7b51e58c44b60241a2238532c2901b543f1cafbc147c14d9877ed554049c10a50b0a561d5b8e71f6985c8d9263b54db1a216d25cfc49d30f3
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1688 wrote to memory of 1156	1688	regsvr32.exe	27
PID 1156 wrote to memory of 848	1156	regsvr32.exe	28
PID 1156 wrote to memory of 848	1156	regsvr32.exe	28
PID 1156 wrote to memory of 848	1156	regsvr32.exe	28
PID 1156 wrote to memory of 848	1156	regsvr32.exe	28
PID 1156 wrote to memory of 848	1156	regsvr32.exe	28
PID 1156 wrote to memory of 848	1156	regsvr32.exe	28
PID 1156 wrote to memory of 848	1156	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ebe2c558b147c2dfacd35abd30be084ab507f9c4a88104e191eaf769adbfa75a_2022-01-19__150107.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ebe2c558b147c2dfacd35abd30be084ab507f9c4a88104e191eaf769adbfa75a_2022-01-19__150107.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_ebe2c558b147c2dfacd35abd30be084ab507f9c4a88104e191eaf769adbfa75a_2022-01-19__150107.exe.dll",DllRegisterServer
    3⤵
    PID:848

memory/1156-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Download

memory/1688-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Download