7a0e719d091f4dc78dc9ab2f7dbe96c1340ee6556f9e830ca6331e35ed37e09a

Analysis

Target
emotet_exe_e4_7a0e719d091f4dc78dc9ab2f7dbe96c1340ee6556f9e830ca6331e35ed37e09a_2022-01-25__000524.dll
Size 780KB
Sample220125-adts4acga5
SHA256 7a0e719d091f4dc78dc9ab2f7dbe96c1340ee6556f9e830ca6331e35ed37e09a
MD5 a3fa2fa2fb62fca2d025109f89f26702
SHA1 4644ad39ded87a76402e33f74791f14c69ef9ff1
SHA512 667be8cca4f318a0f6281c539a1b611a45f7b48cca9cdbec878eda6814fbcf27ac549eba1c965efa77a1af55db6abd531afe1633ae5dac6d150d54d8a1032254
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 3724	3664	regsvr32.exe	68
PID 3664 wrote to memory of 3724	3664	regsvr32.exe	68
PID 3664 wrote to memory of 3724	3664	regsvr32.exe	68
PID 3724 wrote to memory of 1944	3724	regsvr32.exe	69
PID 3724 wrote to memory of 1944	3724	regsvr32.exe	69
PID 3724 wrote to memory of 1944	3724	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7a0e719d091f4dc78dc9ab2f7dbe96c1340ee6556f9e830ca6331e35ed37e09a_2022-01-25__000524.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7a0e719d091f4dc78dc9ab2f7dbe96c1340ee6556f9e830ca6331e35ed37e09a_2022-01-25__000524.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7a0e719d091f4dc78dc9ab2f7dbe96c1340ee6556f9e830ca6331e35ed37e09a_2022-01-25__000524.dll",DllRegisterServer
    3⤵
    PID:1944