868d29ec2d3a588d882f0f2cec1153afa788f34e9c9cd2f67da912e62aa2cdc9

Analysis

Target
emotet_exe_e4_868d29ec2d3a588d882f0f2cec1153afa788f34e9c9cd2f67da912e62aa2cdc9_2022-01-26__192009.dll
Size 496KB
Sample220126-x2nnbahfg5
SHA256 868d29ec2d3a588d882f0f2cec1153afa788f34e9c9cd2f67da912e62aa2cdc9
MD5 8255a4289d671fb8a1a31541088e01ff
SHA1 8586d77f7c97b2eb1b0c7ce71f0a77a0d77aa5cf
SHA512 9b2a2b9bef4d31be8dbbac8ec037f75a6e660ea8da5ec3c7486f7c488a46bea19754490bf4adb777ec64eb1c4a54d902419d472201fd8d2b2625d4ad9b7223d7
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2772	2452	regsvr32.exe	68
PID 2452 wrote to memory of 2772	2452	regsvr32.exe	68
PID 2452 wrote to memory of 2772	2452	regsvr32.exe	68
PID 2772 wrote to memory of 3464	2772	regsvr32.exe	69
PID 2772 wrote to memory of 3464	2772	regsvr32.exe	69
PID 2772 wrote to memory of 3464	2772	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_868d29ec2d3a588d882f0f2cec1153afa788f34e9c9cd2f67da912e62aa2cdc9_2022-01-26__192009.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_868d29ec2d3a588d882f0f2cec1153afa788f34e9c9cd2f67da912e62aa2cdc9_2022-01-26__192009.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_868d29ec2d3a588d882f0f2cec1153afa788f34e9c9cd2f67da912e62aa2cdc9_2022-01-26__192009.dll",DllRegisterServer
    3⤵
    PID:3464