d731220487501160a6fd2d6c64fbedd49ba5a7064c775eb5e87db4eb0bebc099

Analysis

Target
emotet_exe_e4_d731220487501160a6fd2d6c64fbedd49ba5a7064c775eb5e87db4eb0bebc099_2022-01-27__000625.dll
Size 496KB
Sample220127-aebznscebq
SHA256 d731220487501160a6fd2d6c64fbedd49ba5a7064c775eb5e87db4eb0bebc099
MD5 635cf952975744e842512b119feb5837
SHA1 49475526bdf74aff39e32b727390b07a66a6a66c
SHA512 906514348c90cd3356f100271c7e7c2aef96b6716ea6d14c3bebb611b7b06951c018a5e87ab6cb2b84049dc35eb5108a468ed074a7e381f045385ebdfbf64270
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 776	3476	regsvr32.exe	68
PID 3476 wrote to memory of 776	3476	regsvr32.exe	68
PID 3476 wrote to memory of 776	3476	regsvr32.exe	68
PID 776 wrote to memory of 3968	776	regsvr32.exe	69
PID 776 wrote to memory of 3968	776	regsvr32.exe	69
PID 776 wrote to memory of 3968	776	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d731220487501160a6fd2d6c64fbedd49ba5a7064c775eb5e87db4eb0bebc099_2022-01-27__000625.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d731220487501160a6fd2d6c64fbedd49ba5a7064c775eb5e87db4eb0bebc099_2022-01-27__000625.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_d731220487501160a6fd2d6c64fbedd49ba5a7064c775eb5e87db4eb0bebc099_2022-01-27__000625.dll",DllRegisterServer
    3⤵
    PID:3968