0bf073b3ef5995325d6b93b8cb6f7b9d092902f9f5d3cf1615f2139f96d4111c

Analysis

Target
emotet_exe_e4_0bf073b3ef5995325d6b93b8cb6f7b9d092902f9f5d3cf1615f2139f96d4111c_2022-01-25__133439.dll
Size 588KB
Sample220125-qv9hwaggf8
SHA256 0bf073b3ef5995325d6b93b8cb6f7b9d092902f9f5d3cf1615f2139f96d4111c
MD5 a1988bcfb411a72de2d5bcbe24530521
SHA1 b90fc72c20c0fb655a40f840423a3a7de0b15efa
SHA512 d05627278a8f3d94eedab0551f52533c510de632210c46d588897b923d1985bed0d013cca19f3dbc39411fabb47b3664646ead3bf7e4bf1a4aba98f528607980
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3680	2760	regsvr32.exe	69
PID 2760 wrote to memory of 3680	2760	regsvr32.exe	69
PID 2760 wrote to memory of 3680	2760	regsvr32.exe	69
PID 3680 wrote to memory of 1168	3680	regsvr32.exe	70
PID 3680 wrote to memory of 1168	3680	regsvr32.exe	70
PID 3680 wrote to memory of 1168	3680	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0bf073b3ef5995325d6b93b8cb6f7b9d092902f9f5d3cf1615f2139f96d4111c_2022-01-25__133439.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0bf073b3ef5995325d6b93b8cb6f7b9d092902f9f5d3cf1615f2139f96d4111c_2022-01-25__133439.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_0bf073b3ef5995325d6b93b8cb6f7b9d092902f9f5d3cf1615f2139f96d4111c_2022-01-25__133439.dll",DllRegisterServer
    3⤵
    PID:1168