0382ac5238738dcf3579e22a932bc8fb1a7fc5df5950e7a716cbb621823fd6fc

Analysis

Target
emotet_exe_e5_0382ac5238738dcf3579e22a932bc8fb1a7fc5df5950e7a716cbb621823fd6fc_2022-01-25__000542.dll
Size 676KB
Sample220125-advemacga9
SHA256 0382ac5238738dcf3579e22a932bc8fb1a7fc5df5950e7a716cbb621823fd6fc
MD5 0ce145d4984c2c96553092e5f1688a24
SHA1 6a86453754fc365c53abb93c4313c99b49303e00
SHA512 cb71ad938932ccc3222271e89b0939ac45b6bf33b781c7a3507ebdb025c54edd30df2ed595405bcf2e15cbb7177c2e69bf93600dd2782e35a26966b45a550349
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2428	2356	regsvr32.exe	68
PID 2356 wrote to memory of 2428	2356	regsvr32.exe	68
PID 2356 wrote to memory of 2428	2356	regsvr32.exe	68
PID 2428 wrote to memory of 2896	2428	regsvr32.exe	69
PID 2428 wrote to memory of 2896	2428	regsvr32.exe	69
PID 2428 wrote to memory of 2896	2428	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0382ac5238738dcf3579e22a932bc8fb1a7fc5df5950e7a716cbb621823fd6fc_2022-01-25__000542.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0382ac5238738dcf3579e22a932bc8fb1a7fc5df5950e7a716cbb621823fd6fc_2022-01-25__000542.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_0382ac5238738dcf3579e22a932bc8fb1a7fc5df5950e7a716cbb621823fd6fc_2022-01-25__000542.dll",DllRegisterServer
    3⤵
    PID:2896