835fae32b0f5425f737bf9b5b02e5b97f2dd60083145a4834d3364fa8f05066a

Analysis

Target
emotet_exe_e4_835fae32b0f5425f737bf9b5b02e5b97f2dd60083145a4834d3364fa8f05066a_2022-01-22__122937.dll
Size 615KB
Sample220122-ppj6csahh2
SHA256 835fae32b0f5425f737bf9b5b02e5b97f2dd60083145a4834d3364fa8f05066a
MD5 322573735a5314a8132eb205a96de32e
SHA1 67ffca898eb7444151d6240f8a6e50310bea19b0
SHA512 d325bbe91608c945d5bfe9537308005df6489e5a2bf35741e7c647c94d8bc36eef0efd6dacb0ed850e9ae46b998149aa779714db0a0e2322cec393ad683a26e0
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 956	1084	regsvr32.exe	27
PID 1084 wrote to memory of 956	1084	regsvr32.exe	27
PID 1084 wrote to memory of 956	1084	regsvr32.exe	27
PID 1084 wrote to memory of 956	1084	regsvr32.exe	27
PID 1084 wrote to memory of 956	1084	regsvr32.exe	27
PID 1084 wrote to memory of 956	1084	regsvr32.exe	27
PID 1084 wrote to memory of 956	1084	regsvr32.exe	27
PID 956 wrote to memory of 1744	956	regsvr32.exe	28
PID 956 wrote to memory of 1744	956	regsvr32.exe	28
PID 956 wrote to memory of 1744	956	regsvr32.exe	28
PID 956 wrote to memory of 1744	956	regsvr32.exe	28
PID 956 wrote to memory of 1744	956	regsvr32.exe	28
PID 956 wrote to memory of 1744	956	regsvr32.exe	28
PID 956 wrote to memory of 1744	956	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_835fae32b0f5425f737bf9b5b02e5b97f2dd60083145a4834d3364fa8f05066a_2022-01-22__122937.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_835fae32b0f5425f737bf9b5b02e5b97f2dd60083145a4834d3364fa8f05066a_2022-01-22__122937.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_835fae32b0f5425f737bf9b5b02e5b97f2dd60083145a4834d3364fa8f05066a_2022-01-22__122937.dll",DllRegisterServer
    3⤵
    PID:1744

memory/956-56-0x00000000763B1000-0x00000000763B3000-memory.dmp

Download

memory/1084-55-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

Download