6b15602aa7125a0d98082ff633e1f9c86bb4ae80a0bcc60345ebee2ce5167d84

Analysis

Target
emotet_exe_e4_6b15602aa7125a0d98082ff633e1f9c86bb4ae80a0bcc60345ebee2ce5167d84_2022-01-24__093603.dll
Size 716KB
Sample220124-llgz2sebbl
SHA256 6b15602aa7125a0d98082ff633e1f9c86bb4ae80a0bcc60345ebee2ce5167d84
MD5 fb0ae287bea43ee292de6e8ab5e51f1d
SHA1 f83fa18cb0ee76767471488b77d3fbf5651a9b7f
SHA512 0bde059a08276594509a31929231a7d9dd049580107c378384eabd77984504c6bad7b2bd180a686be7b55877dd41252baebfd2ac68515160eb03720f99fd09ce
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 2476	3704	regsvr32.exe	69
PID 3704 wrote to memory of 2476	3704	regsvr32.exe	69
PID 3704 wrote to memory of 2476	3704	regsvr32.exe	69
PID 2476 wrote to memory of 2588	2476	regsvr32.exe	70
PID 2476 wrote to memory of 2588	2476	regsvr32.exe	70
PID 2476 wrote to memory of 2588	2476	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6b15602aa7125a0d98082ff633e1f9c86bb4ae80a0bcc60345ebee2ce5167d84_2022-01-24__093603.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6b15602aa7125a0d98082ff633e1f9c86bb4ae80a0bcc60345ebee2ce5167d84_2022-01-24__093603.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6b15602aa7125a0d98082ff633e1f9c86bb4ae80a0bcc60345ebee2ce5167d84_2022-01-24__093603.dll",DllRegisterServer
    3⤵
    PID:2588