emotet | dfbe810212945696d9b25be0b78ce9b2e24affb668e4e5c324f6a76470f48dc1

Analysis

Target
ec6e3ae95fcd608a3f078da111c2f885.dll
Size 512KB
Sample220127-3p1d8sdbc6
SHA256 dfbe810212945696d9b25be0b78ce9b2e24affb668e4e5c324f6a76470f48dc1
MD5 ec6e3ae95fcd608a3f078da111c2f885
SHA1 57d5b7a74e9d75b7cc651e45ba145223eb9f3c0f
SHA512 47206619688fe395318d1e06decc23e964eb95359167f5b8c538737ab1549f006579b7bce17cd0d421be79be2ee15d58dd3515be1be7c22b09c16d34adfd1a54
MD5 SHA1 SHA512

Score

10^/10

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 2616	3692	regsvr32.exe	69
PID 3692 wrote to memory of 2616	3692	regsvr32.exe	69
PID 3692 wrote to memory of 2616	3692	regsvr32.exe	69
PID 2616 wrote to memory of 3048	2616	regsvr32.exe	70
PID 2616 wrote to memory of 3048	2616	regsvr32.exe	70
PID 2616 wrote to memory of 3048	2616	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ec6e3ae95fcd608a3f078da111c2f885.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ec6e3ae95fcd608a3f078da111c2f885.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ec6e3ae95fcd608a3f078da111c2f885.dll",DllRegisterServer
    3⤵
    PID:3048

memory/2616-118-0x0000000004491000-0x00000000044B2000-memory.dmp

Download