794f60fa34311a38ce0488952e106490d771e484add52004ce80ae2c1aea61d4

Analysis

Target
emotet_exe_e4_794f60fa34311a38ce0488952e106490d771e484add52004ce80ae2c1aea61d4_2022-01-26__000334.dll
Size 660KB
Sample220126-acmcmaadb2
SHA256 794f60fa34311a38ce0488952e106490d771e484add52004ce80ae2c1aea61d4
MD5 552812d8e5700bb88fe86c4b2c55d766
SHA1 c3f9ccccd4353a326b5a8487388953978d81c63f
SHA512 c89dd178eb78c1910683d0b5423b61cfeb4873dfdcedee44f9b3992bd161cd272044d2f6bbb9f5e443ee29d628a50f1f2dd8546913e91a7516cf2102e30b44fa
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4132	3416	regsvr32.exe	69
PID 3416 wrote to memory of 4132	3416	regsvr32.exe	69
PID 3416 wrote to memory of 4132	3416	regsvr32.exe	69
PID 4132 wrote to memory of 3040	4132	regsvr32.exe	70
PID 4132 wrote to memory of 3040	4132	regsvr32.exe	70
PID 4132 wrote to memory of 3040	4132	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_794f60fa34311a38ce0488952e106490d771e484add52004ce80ae2c1aea61d4_2022-01-26__000334.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_794f60fa34311a38ce0488952e106490d771e484add52004ce80ae2c1aea61d4_2022-01-26__000334.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_794f60fa34311a38ce0488952e106490d771e484add52004ce80ae2c1aea61d4_2022-01-26__000334.dll",DllRegisterServer
    3⤵
    PID:3040