39ca9e52881d6d420be78136792aaa0be741cbf3c3e0042f18246bbc8c19471d

Analysis

Target
emotet_exe_e5_39ca9e52881d6d420be78136792aaa0be741cbf3c3e0042f18246bbc8c19471d_2022-01-20__065013.exe.dll
Size 560KB
Sample220120-hmgtwsgeej
SHA256 39ca9e52881d6d420be78136792aaa0be741cbf3c3e0042f18246bbc8c19471d
MD5 a11c09221c3e965d0a21c605ab1aec30
SHA1 755cba2b53136e558219ff9dfb13aa99dfdaaaf6
SHA512 c3f7588303b247d7800d2d9cc2fefcb086d338b64ac6cd86fbe9cf130b3d15da1e5aa8e6c87d4b476a0c3bd52aa2434ac661c41262bbb0ce8a3b08a90300daf8
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 4032	1336	regsvr32.exe	53
PID 1336 wrote to memory of 4032	1336	regsvr32.exe	53
PID 1336 wrote to memory of 4032	1336	regsvr32.exe	53
PID 4032 wrote to memory of 1852	4032	regsvr32.exe	55
PID 4032 wrote to memory of 1852	4032	regsvr32.exe	55
PID 4032 wrote to memory of 1852	4032	regsvr32.exe	55

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_39ca9e52881d6d420be78136792aaa0be741cbf3c3e0042f18246bbc8c19471d_2022-01-20__065013.exe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_39ca9e52881d6d420be78136792aaa0be741cbf3c3e0042f18246bbc8c19471d_2022-01-20__065013.exe.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_39ca9e52881d6d420be78136792aaa0be741cbf3c3e0042f18246bbc8c19471d_2022-01-20__065013.exe.dll",DllRegisterServer
    3⤵
    PID:1852