c9316bbb691f5304f8235608220119680d87cfbdaaffcb2b8161022d32f37ef3

Analysis

Target
emotet_exe_e4_c9316bbb691f5304f8235608220119680d87cfbdaaffcb2b8161022d32f37ef3_2022-01-26__192008.dll
Size 496KB
Sample220126-x2nnbahccq
SHA256 c9316bbb691f5304f8235608220119680d87cfbdaaffcb2b8161022d32f37ef3
MD5 ba352106f207bec66c0c2d1a00a5826d
SHA1 95e239d75d0311c00ad8dba19ae82ab3a2d344bd
SHA512 062105f2856aacbc821f290147c88ea2806556a2029a1afedeb110ec1ea90706068cdcf9b51bc8458de80be6d31ceace7c67b32c71bd36240aa2048d359e6366
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 2332	1020	regsvr32.exe	68
PID 1020 wrote to memory of 2332	1020	regsvr32.exe	68
PID 1020 wrote to memory of 2332	1020	regsvr32.exe	68
PID 2332 wrote to memory of 816	2332	regsvr32.exe	69
PID 2332 wrote to memory of 816	2332	regsvr32.exe	69
PID 2332 wrote to memory of 816	2332	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_c9316bbb691f5304f8235608220119680d87cfbdaaffcb2b8161022d32f37ef3_2022-01-26__192008.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_c9316bbb691f5304f8235608220119680d87cfbdaaffcb2b8161022d32f37ef3_2022-01-26__192008.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_c9316bbb691f5304f8235608220119680d87cfbdaaffcb2b8161022d32f37ef3_2022-01-26__192008.dll",DllRegisterServer
    3⤵
    PID:816