db2c7e94980476bc01b9b2aa650c8e6086c8eb9924d2c02b306aeb11df746d70

Analysis

Target
emotet_exe_e5_db2c7e94980476bc01b9b2aa650c8e6086c8eb9924d2c02b306aeb11df746d70_2022-01-28__000110.dll
Size 520KB
Sample220128-abhcaadcf4
SHA256 db2c7e94980476bc01b9b2aa650c8e6086c8eb9924d2c02b306aeb11df746d70
MD5 b340186c4e23fa24df1539eb77886c4c
SHA1 417c6025d8347647f553031e5ebf1334ec292b46
SHA512 d5f5813616b115affe55efa422dcdf7d02f19541d73c2c2d8ad2736ca26bf03bd01914a2f49cb32e1bbdda508ff434af97d4d6f9f741681bcee260f787472c11
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 3104	3780	regsvr32.exe	69
PID 3780 wrote to memory of 3104	3780	regsvr32.exe	69
PID 3780 wrote to memory of 3104	3780	regsvr32.exe	69
PID 3104 wrote to memory of 3912	3104	regsvr32.exe	70
PID 3104 wrote to memory of 3912	3104	regsvr32.exe	70
PID 3104 wrote to memory of 3912	3104	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_db2c7e94980476bc01b9b2aa650c8e6086c8eb9924d2c02b306aeb11df746d70_2022-01-28__000110.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_db2c7e94980476bc01b9b2aa650c8e6086c8eb9924d2c02b306aeb11df746d70_2022-01-28__000110.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_db2c7e94980476bc01b9b2aa650c8e6086c8eb9924d2c02b306aeb11df746d70_2022-01-28__000110.dll",DllRegisterServer
    3⤵
    PID:3912