e346bb6966c9a8bd1a63c4e17077b67c0ed2affc35867440075699ab0a75a8d4

Analysis

Target
emotet_exe_e4_e346bb6966c9a8bd1a63c4e17077b67c0ed2affc35867440075699ab0a75a8d4_2022-01-28__050650.dll
Size 629KB
Sample220128-fr2zhsfhbn
SHA256 e346bb6966c9a8bd1a63c4e17077b67c0ed2affc35867440075699ab0a75a8d4
MD5 70b12e3539f23280e5a960772b7cfe7d
SHA1 49c67ebc7ef8d48786c0f163ac459e0466819067
SHA512 936e93969209d045dbde6c21f3e48b72670e8a678c1dd4f2d9ebb9ce099f1e74d93d9e854a834a3e168e1a9c427e81ce0198ee2b362e7418b182da5909a1e14f
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 2784	3332	regsvr32.exe	68
PID 3332 wrote to memory of 2784	3332	regsvr32.exe	68
PID 3332 wrote to memory of 2784	3332	regsvr32.exe	68
PID 2784 wrote to memory of 736	2784	regsvr32.exe	69
PID 2784 wrote to memory of 736	2784	regsvr32.exe	69
PID 2784 wrote to memory of 736	2784	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e346bb6966c9a8bd1a63c4e17077b67c0ed2affc35867440075699ab0a75a8d4_2022-01-28__050650.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e346bb6966c9a8bd1a63c4e17077b67c0ed2affc35867440075699ab0a75a8d4_2022-01-28__050650.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e346bb6966c9a8bd1a63c4e17077b67c0ed2affc35867440075699ab0a75a8d4_2022-01-28__050650.dll",DllRegisterServer
    3⤵
    PID:736