f596aa2841c0030c9f6a2e13b3d4762d0ad158b6b4e7452693adacb77914c02a

Analysis

Target
emotet_exe_e4_f596aa2841c0030c9f6a2e13b3d4762d0ad158b6b4e7452693adacb77914c02a_2022-01-26__192010.dll
Size 496KB
Sample220126-x2nnbahcdl
SHA256 f596aa2841c0030c9f6a2e13b3d4762d0ad158b6b4e7452693adacb77914c02a
MD5 d5ad830515720df02fb56ba94b8eebe6
SHA1 dc28e27488d6c2ec2ee5f617d7e792810e4e1529
SHA512 ff0681d02e71a4a6e1c8f2f44952056cbccf52767be5bed4bcdbd44f4a0e8a7f7c297a0bf9fe71d6cbb085b3137c47134f980378e0673a1d908e2c5cf8e2b34d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1576	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1576	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1576	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1576	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1576	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1576	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1576	1600	regsvr32.exe	27
PID 1576 wrote to memory of 1764	1576	regsvr32.exe	28
PID 1576 wrote to memory of 1764	1576	regsvr32.exe	28
PID 1576 wrote to memory of 1764	1576	regsvr32.exe	28
PID 1576 wrote to memory of 1764	1576	regsvr32.exe	28
PID 1576 wrote to memory of 1764	1576	regsvr32.exe	28
PID 1576 wrote to memory of 1764	1576	regsvr32.exe	28
PID 1576 wrote to memory of 1764	1576	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f596aa2841c0030c9f6a2e13b3d4762d0ad158b6b4e7452693adacb77914c02a_2022-01-26__192010.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f596aa2841c0030c9f6a2e13b3d4762d0ad158b6b4e7452693adacb77914c02a_2022-01-26__192010.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f596aa2841c0030c9f6a2e13b3d4762d0ad158b6b4e7452693adacb77914c02a_2022-01-26__192010.dll",DllRegisterServer
    3⤵
    PID:1764

memory/1576-54-0x0000000075601000-0x0000000075603000-memory.dmp

Download

memory/1600-53-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Download