5ee19fc55459c8394eb1eaffe745ebb8da20e406b9229a309364469823944ec9

Analysis

Target
emotet_exe_e4_5ee19fc55459c8394eb1eaffe745ebb8da20e406b9229a309364469823944ec9_2022-01-27__000623.dll
Size 496KB
Sample220127-aebnxacebk
SHA256 5ee19fc55459c8394eb1eaffe745ebb8da20e406b9229a309364469823944ec9
MD5 4e842f85adec639e8cf6e22fcc8eaeae
SHA1 fbddf23670d50136d49bb4e15cd8b89ff7a420ee
SHA512 a1fda8ea97702c268692c44c363aab153091dbf9172e663a542016472b709dc6ee6aa483049ea66eb938d3e49d6c72c5f8b99eb2e71b1848079813b073369c14
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 3664	3788	regsvr32.exe	69
PID 3788 wrote to memory of 3664	3788	regsvr32.exe	69
PID 3788 wrote to memory of 3664	3788	regsvr32.exe	69
PID 3664 wrote to memory of 4100	3664	regsvr32.exe	70
PID 3664 wrote to memory of 4100	3664	regsvr32.exe	70
PID 3664 wrote to memory of 4100	3664	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5ee19fc55459c8394eb1eaffe745ebb8da20e406b9229a309364469823944ec9_2022-01-27__000623.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5ee19fc55459c8394eb1eaffe745ebb8da20e406b9229a309364469823944ec9_2022-01-27__000623.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5ee19fc55459c8394eb1eaffe745ebb8da20e406b9229a309364469823944ec9_2022-01-27__000623.dll",DllRegisterServer
    3⤵
    PID:4100