cf4dba0dff851add1bc93e04e01d3084b771494987d9ced86bf686d6c2cb18eb

Analysis

Target
emotet_exe_e5_cf4dba0dff851add1bc93e04e01d3084b771494987d9ced86bf686d6c2cb18eb_2022-01-28__000112.dll
Size 520KB
Sample220128-abhcaacfgr
SHA256 cf4dba0dff851add1bc93e04e01d3084b771494987d9ced86bf686d6c2cb18eb
MD5 31ad52b0d8beda144cf077116119dc6a
SHA1 46831950a5190f46f34d258701387989b66e22b5
SHA512 3b04acdb406ebdaf5fe7ceadaecf609319cbd56700c78d536d99533136fa8ed1cf9a2d822940903c701083fda3dcd02ed7cfece34c6a67f7f95228605d7891c7
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1824	864	regsvr32.exe	27
PID 864 wrote to memory of 1824	864	regsvr32.exe	27
PID 864 wrote to memory of 1824	864	regsvr32.exe	27
PID 864 wrote to memory of 1824	864	regsvr32.exe	27
PID 864 wrote to memory of 1824	864	regsvr32.exe	27
PID 864 wrote to memory of 1824	864	regsvr32.exe	27
PID 864 wrote to memory of 1824	864	regsvr32.exe	27
PID 1824 wrote to memory of 584	1824	regsvr32.exe	28
PID 1824 wrote to memory of 584	1824	regsvr32.exe	28
PID 1824 wrote to memory of 584	1824	regsvr32.exe	28
PID 1824 wrote to memory of 584	1824	regsvr32.exe	28
PID 1824 wrote to memory of 584	1824	regsvr32.exe	28
PID 1824 wrote to memory of 584	1824	regsvr32.exe	28
PID 1824 wrote to memory of 584	1824	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cf4dba0dff851add1bc93e04e01d3084b771494987d9ced86bf686d6c2cb18eb_2022-01-28__000112.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cf4dba0dff851add1bc93e04e01d3084b771494987d9ced86bf686d6c2cb18eb_2022-01-28__000112.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cf4dba0dff851add1bc93e04e01d3084b771494987d9ced86bf686d6c2cb18eb_2022-01-28__000112.dll",DllRegisterServer
    3⤵
    PID:584

memory/864-55-0x000007FEFB781000-0x000007FEFB783000-memory.dmp

Download

memory/1824-56-0x0000000075421000-0x0000000075423000-memory.dmp

Download