5df60a3b1928f810408c19311730fef9990d1ef22d3749db402b1866d3d46fc2

Analysis

Target
emotet_exe_e4_5df60a3b1928f810408c19311730fef9990d1ef22d3749db402b1866d3d46fc2_2022-01-24__175225.dll
Size 780KB
Sample220124-wga12sgbd4
SHA256 5df60a3b1928f810408c19311730fef9990d1ef22d3749db402b1866d3d46fc2
MD5 fd44b357b7eb506472ee4939f4f695f0
SHA1 68fbe3e7d6900f191f5d853521efcd0e47a34ec3
SHA512 02a5c7f82dd93a0738c002e1dbec6f10a9ed650fba09724f0df1918731e653fbee6fb368a1068b68f0d4a3b8af21618a725cac8b8ee50d95dbdb7b58c9244c8f
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 3596	2780	regsvr32.exe	68
PID 2780 wrote to memory of 3596	2780	regsvr32.exe	68
PID 2780 wrote to memory of 3596	2780	regsvr32.exe	68
PID 3596 wrote to memory of 3168	3596	regsvr32.exe	69
PID 3596 wrote to memory of 3168	3596	regsvr32.exe	69
PID 3596 wrote to memory of 3168	3596	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5df60a3b1928f810408c19311730fef9990d1ef22d3749db402b1866d3d46fc2_2022-01-24__175225.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5df60a3b1928f810408c19311730fef9990d1ef22d3749db402b1866d3d46fc2_2022-01-24__175225.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5df60a3b1928f810408c19311730fef9990d1ef22d3749db402b1866d3d46fc2_2022-01-24__175225.dll",DllRegisterServer
    3⤵
    PID:3168