02a944dfd2016d455a9f582f81a11570edf7fbb54067942ccef80580a32c781d

Analysis

Target
emotet_exe_e4_02a944dfd2016d455a9f582f81a11570edf7fbb54067942ccef80580a32c781d_2022-01-28__050649.dll
Size 629KB
Sample220128-fr2zhsgde6
SHA256 02a944dfd2016d455a9f582f81a11570edf7fbb54067942ccef80580a32c781d
MD5 e2989e1be4feb7507db7702f8637ad97
SHA1 096998d72b49b59d90244a5f37f61fc744417acb
SHA512 84ddd08423a0f74b9dde55f46627adc96fa7603e5b7b2b0d641a8e0267f2c6f4ca0148245253aa09fa74fbd2168f930a3185e459bb4435519cadfe2e9c6ada49
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 3100	3724	regsvr32.exe	68
PID 3724 wrote to memory of 3100	3724	regsvr32.exe	68
PID 3724 wrote to memory of 3100	3724	regsvr32.exe	68
PID 3100 wrote to memory of 3760	3100	regsvr32.exe	69
PID 3100 wrote to memory of 3760	3100	regsvr32.exe	69
PID 3100 wrote to memory of 3760	3100	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_02a944dfd2016d455a9f582f81a11570edf7fbb54067942ccef80580a32c781d_2022-01-28__050649.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_02a944dfd2016d455a9f582f81a11570edf7fbb54067942ccef80580a32c781d_2022-01-28__050649.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_02a944dfd2016d455a9f582f81a11570edf7fbb54067942ccef80580a32c781d_2022-01-28__050649.dll",DllRegisterServer
    3⤵
    PID:3760