bebe940ab36f6f37cac7ea7ff1a614c6cb165f4c9574d544fd9c7aaa802ccdaf

Analysis

Target
emotet_exe_e5_bebe940ab36f6f37cac7ea7ff1a614c6cb165f4c9574d544fd9c7aaa802ccdaf_2022-01-26__000604.dll
Size 596KB
Sample220126-aeck7sadg8
SHA256 bebe940ab36f6f37cac7ea7ff1a614c6cb165f4c9574d544fd9c7aaa802ccdaf
MD5 39f107ba7f663ebf6ef9a0fb1295f0fd
SHA1 861721c2ea1f591abb3b71fdd5938054387a65d1
SHA512 cfbdc85a2ea7d846ab79502737978c3b2a6ca63c06fa2caaab0bb17df24c9d12860e136b1932192bc6cf1d5cb9aaaae97c0ce2205a2212416f68ca00516342e5
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2376	3064	regsvr32.exe	68
PID 3064 wrote to memory of 2376	3064	regsvr32.exe	68
PID 3064 wrote to memory of 2376	3064	regsvr32.exe	68
PID 2376 wrote to memory of 1628	2376	regsvr32.exe	69
PID 2376 wrote to memory of 1628	2376	regsvr32.exe	69
PID 2376 wrote to memory of 1628	2376	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bebe940ab36f6f37cac7ea7ff1a614c6cb165f4c9574d544fd9c7aaa802ccdaf_2022-01-26__000604.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bebe940ab36f6f37cac7ea7ff1a614c6cb165f4c9574d544fd9c7aaa802ccdaf_2022-01-26__000604.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_bebe940ab36f6f37cac7ea7ff1a614c6cb165f4c9574d544fd9c7aaa802ccdaf_2022-01-26__000604.dll",DllRegisterServer
    3⤵
    PID:1628