f6dc5ba6e5f28fadeb73f854fa656b3fa6f3a9789ac764e60e8c084281035e5d

Analysis

Target
emotet_list_ioc_cronupTue_Jan_25_115453_PM_CST_2022.dll
Size 612KB
Sample220126-gwkfpshfel
SHA256 f6dc5ba6e5f28fadeb73f854fa656b3fa6f3a9789ac764e60e8c084281035e5d
MD5 b6a679f84574151ee677205c4b028f37
SHA1 7ae4b09080719aac8a4f988f042d34f290e14b39
SHA512 02e10903a6ac9e729deb2b52bc029fd930901d86421124d3784f8fcc629b5d0e026285bd4a1e8cd264dd35a7c9fb0219185e2bb7e920fe874349b4a15d32bbd5
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 4132	3592	regsvr32.exe	69
PID 3592 wrote to memory of 4132	3592	regsvr32.exe	69
PID 3592 wrote to memory of 4132	3592	regsvr32.exe	69
PID 4132 wrote to memory of 4088	4132	regsvr32.exe	70
PID 4132 wrote to memory of 4088	4132	regsvr32.exe	70
PID 4132 wrote to memory of 4088	4132	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_115453_PM_CST_2022.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_115453_PM_CST_2022.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_list_ioc_cronupTue_Jan_25_115453_PM_CST_2022.dll",DllRegisterServer
    3⤵
    PID:4088