cb2da207772f066cfd9d58cad423a2c854b71f69e5c60c019e8f41e4ff54913d

Analysis

Target
emotet_exe_e5_cb2da207772f066cfd9d58cad423a2c854b71f69e5c60c019e8f41e4ff54913d_2022-01-28__074902.dll
Size 638KB
Sample220128-jpdexshhf4
SHA256 cb2da207772f066cfd9d58cad423a2c854b71f69e5c60c019e8f41e4ff54913d
MD5 01d2066734a8a189f65e18e5deaf131c
SHA1 7ab7e807909fa3a416aff5c3acd6beeeeaa6b5e4
SHA512 44520158951b0bc27c6ab19a615765d33b181c7d94b8a8780f2bdebef01305fe58cd5e87101741538c56c47d7754229d4b1903da26dc6dc567cfaba16cc3f543
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2428	2384	regsvr32.exe	68
PID 2384 wrote to memory of 2428	2384	regsvr32.exe	68
PID 2384 wrote to memory of 2428	2384	regsvr32.exe	68
PID 2428 wrote to memory of 3776	2428	regsvr32.exe	69
PID 2428 wrote to memory of 3776	2428	regsvr32.exe	69
PID 2428 wrote to memory of 3776	2428	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cb2da207772f066cfd9d58cad423a2c854b71f69e5c60c019e8f41e4ff54913d_2022-01-28__074902.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cb2da207772f066cfd9d58cad423a2c854b71f69e5c60c019e8f41e4ff54913d_2022-01-28__074902.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cb2da207772f066cfd9d58cad423a2c854b71f69e5c60c019e8f41e4ff54913d_2022-01-28__074902.dll",DllRegisterServer
    3⤵
    PID:3776