1b2a5cc15dcfdd93c5e5e9edbc428d4aecf23285c671e1f26255762aa3a59194

Analysis

Target
emotet_exe_e5_1b2a5cc15dcfdd93c5e5e9edbc428d4aecf23285c671e1f26255762aa3a59194_2022-01-25__171334.dll
Size 596KB
Sample220125-vrz79abgh7
SHA256 1b2a5cc15dcfdd93c5e5e9edbc428d4aecf23285c671e1f26255762aa3a59194
MD5 85a9c24d2bd7c5618bfbd70f8dc8adac
SHA1 521b9d7375c8266388b7e1c5b269dcc345c406c1
SHA512 4286a307ee40bc52ef0840c8e42844deffa6620dc3a07c1c9892528eb25a2228d0634fffb505393419ab143fc3969109ec6ec9048b6454ad03613f0d3d706b33
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 3144	4016	regsvr32.exe	69
PID 4016 wrote to memory of 3144	4016	regsvr32.exe	69
PID 4016 wrote to memory of 3144	4016	regsvr32.exe	69
PID 3144 wrote to memory of 1324	3144	regsvr32.exe	70
PID 3144 wrote to memory of 1324	3144	regsvr32.exe	70
PID 3144 wrote to memory of 1324	3144	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1b2a5cc15dcfdd93c5e5e9edbc428d4aecf23285c671e1f26255762aa3a59194_2022-01-25__171334.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1b2a5cc15dcfdd93c5e5e9edbc428d4aecf23285c671e1f26255762aa3a59194_2022-01-25__171334.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_1b2a5cc15dcfdd93c5e5e9edbc428d4aecf23285c671e1f26255762aa3a59194_2022-01-25__171334.dll",DllRegisterServer
    3⤵
    PID:1324