e325abf74cc1b4e7310d12ac7319e7c2ebef5277123e89d6fb1fead2550a5b41

Analysis

Target
emotet_exe_e4_e325abf74cc1b4e7310d12ac7319e7c2ebef5277123e89d6fb1fead2550a5b41_2022-01-25__133441.dll
Size 588KB
Sample220125-qv9tmsgeeq
SHA256 e325abf74cc1b4e7310d12ac7319e7c2ebef5277123e89d6fb1fead2550a5b41
MD5 8df634a339ceed89d637a9c85c067a02
SHA1 baf0a934b962199ecd29f36ef85d4b98dd499e87
SHA512 085181ca1722e2e6d0e8d9c3c65e2f5d5fe78770788f3457562b6dc3daa7fdeebb4d58dee2853c76242f583543159056166436aabc5ddadbad9cd04d33fbf0fe
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 1352	508	regsvr32.exe	69
PID 508 wrote to memory of 1352	508	regsvr32.exe	69
PID 508 wrote to memory of 1352	508	regsvr32.exe	69
PID 1352 wrote to memory of 3952	1352	regsvr32.exe	70
PID 1352 wrote to memory of 3952	1352	regsvr32.exe	70
PID 1352 wrote to memory of 3952	1352	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e325abf74cc1b4e7310d12ac7319e7c2ebef5277123e89d6fb1fead2550a5b41_2022-01-25__133441.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:508
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e325abf74cc1b4e7310d12ac7319e7c2ebef5277123e89d6fb1fead2550a5b41_2022-01-25__133441.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e325abf74cc1b4e7310d12ac7319e7c2ebef5277123e89d6fb1fead2550a5b41_2022-01-25__133441.dll",DllRegisterServer
    3⤵
    PID:3952