e9138ef1eda9eeff0ab08c1ce19d2b3166335da20957fb9467a7092a72cd2563

Analysis

Target
emotet_exe_e4_e9138ef1eda9eeff0ab08c1ce19d2b3166335da20957fb9467a7092a72cd2563_2022-01-26__192010.dll
Size 496KB
Sample220126-x2nnbahff9
SHA256 e9138ef1eda9eeff0ab08c1ce19d2b3166335da20957fb9467a7092a72cd2563
MD5 f349ef64b82f76aa4d2c3fbc8187028e
SHA1 074db9ae6cfa8f3a64489a4969eea465d0fe5636
SHA512 daa71682458f17a23896e83e0903b9e7d9d773f6d45c615939600e68f2255f4a3a62d407b730ca71d8912560701947b8f256c024cd4aa3c00ffa4e58f0ee3ca0
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2268	2064	regsvr32.exe	68
PID 2064 wrote to memory of 2268	2064	regsvr32.exe	68
PID 2064 wrote to memory of 2268	2064	regsvr32.exe	68
PID 2268 wrote to memory of 3488	2268	regsvr32.exe	70
PID 2268 wrote to memory of 3488	2268	regsvr32.exe	70
PID 2268 wrote to memory of 3488	2268	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e9138ef1eda9eeff0ab08c1ce19d2b3166335da20957fb9467a7092a72cd2563_2022-01-26__192010.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e9138ef1eda9eeff0ab08c1ce19d2b3166335da20957fb9467a7092a72cd2563_2022-01-26__192010.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e9138ef1eda9eeff0ab08c1ce19d2b3166335da20957fb9467a7092a72cd2563_2022-01-26__192010.dll",DllRegisterServer
    3⤵
    PID:3488