438929b8711b68fc1263ea8fdd68b3eab42e2a5ea9ec7cd6df0123670eea7b85

Analysis

Target
emotet_exe_e5_438929b8711b68fc1263ea8fdd68b3eab42e2a5ea9ec7cd6df0123670eea7b85_2022-01-25__000543.dll
Size 676KB
Sample220125-adwbxschcp
SHA256 438929b8711b68fc1263ea8fdd68b3eab42e2a5ea9ec7cd6df0123670eea7b85
MD5 07a659123b7b507593524e4f632b0ffa
SHA1 2c9e8bfb3dd964b3a6a8b68ef1b1808830df9a07
SHA512 6feceea60a2d94960e37b9a649f92cab3a071632ea855b6f063a46b7ad909076005aed911335fff11ba4a4c5d2b73615f1aa5c197c5bb792cf29dc257390d037
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 852	2848	regsvr32.exe	69
PID 2848 wrote to memory of 852	2848	regsvr32.exe	69
PID 2848 wrote to memory of 852	2848	regsvr32.exe	69
PID 852 wrote to memory of 1524	852	regsvr32.exe	70
PID 852 wrote to memory of 1524	852	regsvr32.exe	70
PID 852 wrote to memory of 1524	852	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_438929b8711b68fc1263ea8fdd68b3eab42e2a5ea9ec7cd6df0123670eea7b85_2022-01-25__000543.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_438929b8711b68fc1263ea8fdd68b3eab42e2a5ea9ec7cd6df0123670eea7b85_2022-01-25__000543.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_438929b8711b68fc1263ea8fdd68b3eab42e2a5ea9ec7cd6df0123670eea7b85_2022-01-25__000543.dll",DllRegisterServer
    3⤵
    PID:1524