11046474b249668755f36b02dd2ea043e2a28a8225d654e635a63449790db84f

Analysis

Target
emotet_exe_e4_11046474b249668755f36b02dd2ea043e2a28a8225d654e635a63449790db84f_2022-01-27__000623.dll
Size 496KB
Sample220127-aebznscgd8
SHA256 11046474b249668755f36b02dd2ea043e2a28a8225d654e635a63449790db84f
MD5 a5d7e3ec561ca8512b428eb635999830
SHA1 bfea00f30424ce0176885c3e578ce276088cc712
SHA512 a487e9565a5d44865ac51ea7eb0cc56411d89cea02a29dc2589ace0d9dfcc969eb6da7ae305b55eccfe54d5cb1b10ce2c63a5c6b47c822c8e96a59526830641f
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1412 wrote to memory of 1492	1412	regsvr32.exe	27
PID 1492 wrote to memory of 336	1492	regsvr32.exe	28
PID 1492 wrote to memory of 336	1492	regsvr32.exe	28
PID 1492 wrote to memory of 336	1492	regsvr32.exe	28
PID 1492 wrote to memory of 336	1492	regsvr32.exe	28
PID 1492 wrote to memory of 336	1492	regsvr32.exe	28
PID 1492 wrote to memory of 336	1492	regsvr32.exe	28
PID 1492 wrote to memory of 336	1492	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_11046474b249668755f36b02dd2ea043e2a28a8225d654e635a63449790db84f_2022-01-27__000623.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_11046474b249668755f36b02dd2ea043e2a28a8225d654e635a63449790db84f_2022-01-27__000623.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_11046474b249668755f36b02dd2ea043e2a28a8225d654e635a63449790db84f_2022-01-27__000623.dll",DllRegisterServer
    3⤵
    PID:336

memory/1412-55-0x000007FEFC371000-0x000007FEFC373000-memory.dmp

Download

memory/1492-56-0x0000000076851000-0x0000000076853000-memory.dmp

Download