ee04b99c4fd755efdb950fa00fbaba35dc76b056261c0ca22bcdefff367a9ba0

Analysis

Target
emotet_exe_e4_ee04b99c4fd755efdb950fa00fbaba35dc76b056261c0ca22bcdefff367a9ba0_2022-01-26__192006.dll
Size 496KB
Sample220126-x2ncjshccn
SHA256 ee04b99c4fd755efdb950fa00fbaba35dc76b056261c0ca22bcdefff367a9ba0
MD5 867eb3ac217237b93af50f8570dfe7c1
SHA1 7ef76e1dfc396e66ee77a2e5dd5228392bd3da68
SHA512 9d31d101113733fc75718f9245b59de10abcd1f7d63d6619b23322c98cf8dc4064c83540d4d601368426f3a67e22a0401a1e7949a2e771113252945e84001533
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2580	2384	regsvr32.exe	68
PID 2384 wrote to memory of 2580	2384	regsvr32.exe	68
PID 2384 wrote to memory of 2580	2384	regsvr32.exe	68
PID 2580 wrote to memory of 3884	2580	regsvr32.exe	69
PID 2580 wrote to memory of 3884	2580	regsvr32.exe	69
PID 2580 wrote to memory of 3884	2580	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ee04b99c4fd755efdb950fa00fbaba35dc76b056261c0ca22bcdefff367a9ba0_2022-01-26__192006.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ee04b99c4fd755efdb950fa00fbaba35dc76b056261c0ca22bcdefff367a9ba0_2022-01-26__192006.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ee04b99c4fd755efdb950fa00fbaba35dc76b056261c0ca22bcdefff367a9ba0_2022-01-26__192006.dll",DllRegisterServer
    3⤵
    PID:3884