f596aa2841c0030c9f6a2e13b3d4762d0ad158b6b4e7452693adacb77914c02a

Analysis

Target
emotet_exe_e4_f596aa2841c0030c9f6a2e13b3d4762d0ad158b6b4e7452693adacb77914c02a_2022-01-26__192010.dll
Size 496KB
Sample220126-x2nnbahcdl
SHA256 f596aa2841c0030c9f6a2e13b3d4762d0ad158b6b4e7452693adacb77914c02a
MD5 d5ad830515720df02fb56ba94b8eebe6
SHA1 dc28e27488d6c2ec2ee5f617d7e792810e4e1529
SHA512 ff0681d02e71a4a6e1c8f2f44952056cbccf52767be5bed4bcdbd44f4a0e8a7f7c297a0bf9fe71d6cbb085b3137c47134f980378e0673a1d908e2c5cf8e2b34d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3492	3004	regsvr32.exe	69
PID 3004 wrote to memory of 3492	3004	regsvr32.exe	69
PID 3004 wrote to memory of 3492	3004	regsvr32.exe	69
PID 3492 wrote to memory of 1344	3492	regsvr32.exe	70
PID 3492 wrote to memory of 1344	3492	regsvr32.exe	70
PID 3492 wrote to memory of 1344	3492	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f596aa2841c0030c9f6a2e13b3d4762d0ad158b6b4e7452693adacb77914c02a_2022-01-26__192010.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f596aa2841c0030c9f6a2e13b3d4762d0ad158b6b4e7452693adacb77914c02a_2022-01-26__192010.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f596aa2841c0030c9f6a2e13b3d4762d0ad158b6b4e7452693adacb77914c02a_2022-01-26__192010.dll",DllRegisterServer
    3⤵
    PID:1344