20d14d4be8542e427dc71a1e921e3d315c57b0013aa3a502073a2fa4dcdad757

Analysis

Target
emotet_exe_e4_20d14d4be8542e427dc71a1e921e3d315c57b0013aa3a502073a2fa4dcdad757_2022-01-25__000523.dll
Size 780KB
Sample220125-adswsscfh6
SHA256 20d14d4be8542e427dc71a1e921e3d315c57b0013aa3a502073a2fa4dcdad757
MD5 6638ca06a1f598c89493bd548b60b9b7
SHA1 25fee74294511b14e8123754aa2f32e2588115e6
SHA512 a52e58ed8e9c2190e2abd2da4ce55039d5d00708b0616ad9eee97852748bb58119a85db9705346b904c2d02e2c1ff57356874a1f169ea4ae2367012da7e17416
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 3724	2708	regsvr32.exe	68
PID 2708 wrote to memory of 3724	2708	regsvr32.exe	68
PID 2708 wrote to memory of 3724	2708	regsvr32.exe	68
PID 3724 wrote to memory of 3796	3724	regsvr32.exe	69
PID 3724 wrote to memory of 3796	3724	regsvr32.exe	69
PID 3724 wrote to memory of 3796	3724	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_20d14d4be8542e427dc71a1e921e3d315c57b0013aa3a502073a2fa4dcdad757_2022-01-25__000523.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_20d14d4be8542e427dc71a1e921e3d315c57b0013aa3a502073a2fa4dcdad757_2022-01-25__000523.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_20d14d4be8542e427dc71a1e921e3d315c57b0013aa3a502073a2fa4dcdad757_2022-01-25__000523.dll",DllRegisterServer
    3⤵
    PID:3796