a4d9e0c03e9d37ca207428fe9ece4cd55ece95ff5eb6e4daefc44e3b79bf6114

Analysis

Target
emotet_exe_e5_a4d9e0c03e9d37ca207428fe9ece4cd55ece95ff5eb6e4daefc44e3b79bf6114_2022-01-27__000844.dll
Size 504KB
Sample220127-aflv9schb3
SHA256 a4d9e0c03e9d37ca207428fe9ece4cd55ece95ff5eb6e4daefc44e3b79bf6114
MD5 ac6bd403f08b9213d60915036d3eacf0
SHA1 d4eabf97b83b4fcd0909f8ef7eeff463a14d96ee
SHA512 24c9fdbf7ac07c5c2da20b84d6362b97e4598133f86a729ac4d1c97ba3e4eb2e1cf60942b23fbe9e2ebe9562287f0d4c518cd55dd9c9146e36b989b3e2b0fd26
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2504	2336	regsvr32.exe	68
PID 2336 wrote to memory of 2504	2336	regsvr32.exe	68
PID 2336 wrote to memory of 2504	2336	regsvr32.exe	68
PID 2504 wrote to memory of 2760	2504	regsvr32.exe	69
PID 2504 wrote to memory of 2760	2504	regsvr32.exe	69
PID 2504 wrote to memory of 2760	2504	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a4d9e0c03e9d37ca207428fe9ece4cd55ece95ff5eb6e4daefc44e3b79bf6114_2022-01-27__000844.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a4d9e0c03e9d37ca207428fe9ece4cd55ece95ff5eb6e4daefc44e3b79bf6114_2022-01-27__000844.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a4d9e0c03e9d37ca207428fe9ece4cd55ece95ff5eb6e4daefc44e3b79bf6114_2022-01-27__000844.dll",DllRegisterServer
    3⤵
    PID:2760