cf4dba0dff851add1bc93e04e01d3084b771494987d9ced86bf686d6c2cb18eb

Analysis

Target
emotet_exe_e5_cf4dba0dff851add1bc93e04e01d3084b771494987d9ced86bf686d6c2cb18eb_2022-01-28__000112.dll
Size 520KB
Sample220128-abhcaacfgr
SHA256 cf4dba0dff851add1bc93e04e01d3084b771494987d9ced86bf686d6c2cb18eb
MD5 31ad52b0d8beda144cf077116119dc6a
SHA1 46831950a5190f46f34d258701387989b66e22b5
SHA512 3b04acdb406ebdaf5fe7ceadaecf609319cbd56700c78d536d99533136fa8ed1cf9a2d822940903c701083fda3dcd02ed7cfece34c6a67f7f95228605d7891c7
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 3056	2716	regsvr32.exe	69
PID 2716 wrote to memory of 3056	2716	regsvr32.exe	69
PID 2716 wrote to memory of 3056	2716	regsvr32.exe	69
PID 3056 wrote to memory of 3716	3056	regsvr32.exe	70
PID 3056 wrote to memory of 3716	3056	regsvr32.exe	70
PID 3056 wrote to memory of 3716	3056	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cf4dba0dff851add1bc93e04e01d3084b771494987d9ced86bf686d6c2cb18eb_2022-01-28__000112.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cf4dba0dff851add1bc93e04e01d3084b771494987d9ced86bf686d6c2cb18eb_2022-01-28__000112.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cf4dba0dff851add1bc93e04e01d3084b771494987d9ced86bf686d6c2cb18eb_2022-01-28__000112.dll",DllRegisterServer
    3⤵
    PID:3716