9e6c937eb781d00f9e0626272bb99cf6d0da28d8a1c2a6b5221fe76d34357805

Analysis

Target
emotet_exe_e4_9e6c937eb781d00f9e0626272bb99cf6d0da28d8a1c2a6b5221fe76d34357805_2022-01-27__000623.dll
Size 496KB
Sample220127-aebznscgd6
SHA256 9e6c937eb781d00f9e0626272bb99cf6d0da28d8a1c2a6b5221fe76d34357805
MD5 a27b68a511753b4a8e491b13eb3a5024
SHA1 360cd25a925b37869ce89e258a6fb504b41f5504
SHA512 1bbfb260d837aa3920aa0380c368bd153cd221d0c8f54a0f082187d2e637ab584a593de27e78da13abe1e08eb63dbd246fe4bdd84570118ba59eee5d4ced7d4e
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2584	2368	regsvr32.exe	68
PID 2368 wrote to memory of 2584	2368	regsvr32.exe	68
PID 2368 wrote to memory of 2584	2368	regsvr32.exe	68
PID 2584 wrote to memory of 3508	2584	regsvr32.exe	69
PID 2584 wrote to memory of 3508	2584	regsvr32.exe	69
PID 2584 wrote to memory of 3508	2584	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9e6c937eb781d00f9e0626272bb99cf6d0da28d8a1c2a6b5221fe76d34357805_2022-01-27__000623.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9e6c937eb781d00f9e0626272bb99cf6d0da28d8a1c2a6b5221fe76d34357805_2022-01-27__000623.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9e6c937eb781d00f9e0626272bb99cf6d0da28d8a1c2a6b5221fe76d34357805_2022-01-27__000623.dll",DllRegisterServer
    3⤵
    PID:3508