794f60fa34311a38ce0488952e106490d771e484add52004ce80ae2c1aea61d4

Analysis

Target
emotet_exe_e4_794f60fa34311a38ce0488952e106490d771e484add52004ce80ae2c1aea61d4_2022-01-26__000334.dll
Size 660KB
Sample220126-acmcmaadb2
SHA256 794f60fa34311a38ce0488952e106490d771e484add52004ce80ae2c1aea61d4
MD5 552812d8e5700bb88fe86c4b2c55d766
SHA1 c3f9ccccd4353a326b5a8487388953978d81c63f
SHA512 c89dd178eb78c1910683d0b5423b61cfeb4873dfdcedee44f9b3992bd161cd272044d2f6bbb9f5e443ee29d628a50f1f2dd8546913e91a7516cf2102e30b44fa
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1512	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1512	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1512	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1512	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1512	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1512	1720	regsvr32.exe	27
PID 1720 wrote to memory of 1512	1720	regsvr32.exe	27
PID 1512 wrote to memory of 1768	1512	regsvr32.exe	28
PID 1512 wrote to memory of 1768	1512	regsvr32.exe	28
PID 1512 wrote to memory of 1768	1512	regsvr32.exe	28
PID 1512 wrote to memory of 1768	1512	regsvr32.exe	28
PID 1512 wrote to memory of 1768	1512	regsvr32.exe	28
PID 1512 wrote to memory of 1768	1512	regsvr32.exe	28
PID 1512 wrote to memory of 1768	1512	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_794f60fa34311a38ce0488952e106490d771e484add52004ce80ae2c1aea61d4_2022-01-26__000334.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_794f60fa34311a38ce0488952e106490d771e484add52004ce80ae2c1aea61d4_2022-01-26__000334.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_794f60fa34311a38ce0488952e106490d771e484add52004ce80ae2c1aea61d4_2022-01-26__000334.dll",DllRegisterServer
    3⤵
    PID:1768

memory/1512-55-0x0000000075601000-0x0000000075603000-memory.dmp

Download

memory/1720-54-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Download