78f286b91d2976eb251fdb3327db9693a3ee6a13d9e7f8421d681df83552753a

Analysis

Target
emotet_exe_e5_78f286b91d2976eb251fdb3327db9693a3ee6a13d9e7f8421d681df83552753a_2022-01-25__171331.dll
Size 596KB
Sample220125-vrz79abehp
SHA256 78f286b91d2976eb251fdb3327db9693a3ee6a13d9e7f8421d681df83552753a
MD5 e71c860bd5d0353cf79780cb49fd80e1
SHA1 8a97c1c30726249d1470796052ecc1bf749f1874
SHA512 df980034cec0a952b2b2861de05689a53e0bbed998be81a5eead0223f120585a2788018661f786ef20eedd9589fea2e714d22102262602d23eb318471d5ad4b3
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2820	2556	regsvr32.exe	68
PID 2556 wrote to memory of 2820	2556	regsvr32.exe	68
PID 2556 wrote to memory of 2820	2556	regsvr32.exe	68
PID 2820 wrote to memory of 4076	2820	regsvr32.exe	69
PID 2820 wrote to memory of 4076	2820	regsvr32.exe	69
PID 2820 wrote to memory of 4076	2820	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_78f286b91d2976eb251fdb3327db9693a3ee6a13d9e7f8421d681df83552753a_2022-01-25__171331.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_78f286b91d2976eb251fdb3327db9693a3ee6a13d9e7f8421d681df83552753a_2022-01-25__171331.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_78f286b91d2976eb251fdb3327db9693a3ee6a13d9e7f8421d681df83552753a_2022-01-25__171331.dll",DllRegisterServer
    3⤵
    PID:4076