632691be3fa30b8d957bb9928dfbf11199fbc67a9582accb32ccde91b9f9b7b4

Analysis

Target
emotet_exe_e4_632691be3fa30b8d957bb9928dfbf11199fbc67a9582accb32ccde91b9f9b7b4_2022-01-28__050651.dll
Size 629KB
Sample220128-fr3aaagde8
SHA256 632691be3fa30b8d957bb9928dfbf11199fbc67a9582accb32ccde91b9f9b7b4
MD5 5af8257bd43830fd59c22c600a1bc497
SHA1 b37fb70c08a4da0101c49afbb001778a9c4f1e29
SHA512 03e03f55b2761979d458980b23d04223f8731d0c5d5cfad1c47358f07f55eff3dfcc2b78e5dd9a0c348adb001fe4685e902c5c174b608b595cdf0c19e26f672e
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2888	2056	regsvr32.exe	69
PID 2056 wrote to memory of 2888	2056	regsvr32.exe	69
PID 2056 wrote to memory of 2888	2056	regsvr32.exe	69
PID 2888 wrote to memory of 2324	2888	regsvr32.exe	70
PID 2888 wrote to memory of 2324	2888	regsvr32.exe	70
PID 2888 wrote to memory of 2324	2888	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_632691be3fa30b8d957bb9928dfbf11199fbc67a9582accb32ccde91b9f9b7b4_2022-01-28__050651.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_632691be3fa30b8d957bb9928dfbf11199fbc67a9582accb32ccde91b9f9b7b4_2022-01-28__050651.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_632691be3fa30b8d957bb9928dfbf11199fbc67a9582accb32ccde91b9f9b7b4_2022-01-28__050651.dll",DllRegisterServer
    3⤵
    PID:2324