2e8c8666062eb6d33eb03513227bb3326878b32bd422b46c9e10604b14252950

Analysis

Target
emotet_exe_e5_2e8c8666062eb6d33eb03513227bb3326878b32bd422b46c9e10604b14252950_2022-01-26__000606.dll
Size 596KB
Sample220126-aec7qsadh5
SHA256 2e8c8666062eb6d33eb03513227bb3326878b32bd422b46c9e10604b14252950
MD5 13b8542b894290e31db23db863b185f7
SHA1 277059c7b9b04c759ccb5ef0d0c77ea9c3c45ca5
SHA512 2ac10056779926e75d5ba3ac19fa51668a39094a79a92f2d39ba1b2f0ab49ee032630d1e767a1314b31a5469ef8485aeb8fbf88b1bed2f4fb6cd20e47ecfd0b8
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2752	2704	regsvr32.exe	69
PID 2704 wrote to memory of 2752	2704	regsvr32.exe	69
PID 2704 wrote to memory of 2752	2704	regsvr32.exe	69
PID 2752 wrote to memory of 2712	2752	regsvr32.exe	70
PID 2752 wrote to memory of 2712	2752	regsvr32.exe	70
PID 2752 wrote to memory of 2712	2752	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2e8c8666062eb6d33eb03513227bb3326878b32bd422b46c9e10604b14252950_2022-01-26__000606.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2e8c8666062eb6d33eb03513227bb3326878b32bd422b46c9e10604b14252950_2022-01-26__000606.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_2e8c8666062eb6d33eb03513227bb3326878b32bd422b46c9e10604b14252950_2022-01-26__000606.dll",DllRegisterServer
    3⤵
    PID:2712