2e8c8666062eb6d33eb03513227bb3326878b32bd422b46c9e10604b14252950

Analysis

Target
emotet_exe_e5_2e8c8666062eb6d33eb03513227bb3326878b32bd422b46c9e10604b14252950_2022-01-26__000606.dll
Size 596KB
Sample220126-aec7qsadh5
SHA256 2e8c8666062eb6d33eb03513227bb3326878b32bd422b46c9e10604b14252950
MD5 13b8542b894290e31db23db863b185f7
SHA1 277059c7b9b04c759ccb5ef0d0c77ea9c3c45ca5
SHA512 2ac10056779926e75d5ba3ac19fa51668a39094a79a92f2d39ba1b2f0ab49ee032630d1e767a1314b31a5469ef8485aeb8fbf88b1bed2f4fb6cd20e47ecfd0b8
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1672	1268	regsvr32.exe	27
PID 1268 wrote to memory of 1672	1268	regsvr32.exe	27
PID 1268 wrote to memory of 1672	1268	regsvr32.exe	27
PID 1268 wrote to memory of 1672	1268	regsvr32.exe	27
PID 1268 wrote to memory of 1672	1268	regsvr32.exe	27
PID 1268 wrote to memory of 1672	1268	regsvr32.exe	27
PID 1268 wrote to memory of 1672	1268	regsvr32.exe	27
PID 1672 wrote to memory of 760	1672	regsvr32.exe	28
PID 1672 wrote to memory of 760	1672	regsvr32.exe	28
PID 1672 wrote to memory of 760	1672	regsvr32.exe	28
PID 1672 wrote to memory of 760	1672	regsvr32.exe	28
PID 1672 wrote to memory of 760	1672	regsvr32.exe	28
PID 1672 wrote to memory of 760	1672	regsvr32.exe	28
PID 1672 wrote to memory of 760	1672	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2e8c8666062eb6d33eb03513227bb3326878b32bd422b46c9e10604b14252950_2022-01-26__000606.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2e8c8666062eb6d33eb03513227bb3326878b32bd422b46c9e10604b14252950_2022-01-26__000606.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2e8c8666062eb6d33eb03513227bb3326878b32bd422b46c9e10604b14252950_2022-01-26__000606.dll",DllRegisterServer
    3⤵
    PID:760

memory/1268-55-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Download

memory/1672-56-0x0000000075F81000-0x0000000075F83000-memory.dmp

Download