f669f43dc989491add7e5b71cb7b6c21fc0bcaae139a998e4c4b9b0913eae50b

Analysis

Target
emotet_exe_e4_f669f43dc989491add7e5b71cb7b6c21fc0bcaae139a998e4c4b9b0913eae50b_2022-01-27__000625.dll
Size 496KB
Sample220127-aecafacge9
SHA256 f669f43dc989491add7e5b71cb7b6c21fc0bcaae139a998e4c4b9b0913eae50b
MD5 3bc294f63a2b72078588d4db21bd5d67
SHA1 fc45902b01af8045ddd27720c573cb15a8b439bd
SHA512 1529c85a8a7f131790396927d95bea32f617949d92fd1bda7610499dc782f6633d84625e67b3f643eb1766f2ac2bc4d757610fcfe81b3b7b89e83a9ac84b6e0c
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 2800	616	regsvr32.exe	69
PID 616 wrote to memory of 2800	616	regsvr32.exe	69
PID 616 wrote to memory of 2800	616	regsvr32.exe	69
PID 2800 wrote to memory of 2468	2800	regsvr32.exe	70
PID 2800 wrote to memory of 2468	2800	regsvr32.exe	70
PID 2800 wrote to memory of 2468	2800	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f669f43dc989491add7e5b71cb7b6c21fc0bcaae139a998e4c4b9b0913eae50b_2022-01-27__000625.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f669f43dc989491add7e5b71cb7b6c21fc0bcaae139a998e4c4b9b0913eae50b_2022-01-27__000625.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f669f43dc989491add7e5b71cb7b6c21fc0bcaae139a998e4c4b9b0913eae50b_2022-01-27__000625.dll",DllRegisterServer
    3⤵
    PID:2468