dc1ccd8ac901ff8ca2e743bd5000e058e0d3f31596a4c729a92c055fa17af303

Analysis

Target
emotet_list_ioc_cronupTue_Jan_25_115355_PM_CST_2022.dll
Size 596KB
Sample220126-gve5lahfaq
SHA256 dc1ccd8ac901ff8ca2e743bd5000e058e0d3f31596a4c729a92c055fa17af303
MD5 0738f0599feea60f9a2cb035ee3db7ae
SHA1 4f897057db56d639dcd4fc188c4b4650599e91f1
SHA512 fee19d16d065f7cfa4fa45347c891f1dbced3ae99f94d0e35c5c541f221876c72f2196429fed48fe9fd07e61b5fa239de62bebefd32c6ea14d5a0823ee778d5f
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2764	2476	regsvr32.exe	68
PID 2476 wrote to memory of 2764	2476	regsvr32.exe	68
PID 2476 wrote to memory of 2764	2476	regsvr32.exe	68
PID 2764 wrote to memory of 3464	2764	regsvr32.exe	69
PID 2764 wrote to memory of 3464	2764	regsvr32.exe	69
PID 2764 wrote to memory of 3464	2764	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_115355_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_115355_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_115355_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:3464