a7652fd0fb951fec53fbfcfc086cc9716c7105dcb45f8bed21e1f95ef0242a95

Analysis

Target
emotet_exe_e5_a7652fd0fb951fec53fbfcfc086cc9716c7105dcb45f8bed21e1f95ef0242a95_2022-01-30__000036.dll
Size 546KB
Sample220130-aaw42scdb4
SHA256 a7652fd0fb951fec53fbfcfc086cc9716c7105dcb45f8bed21e1f95ef0242a95
MD5 0dad845dbfb5c9736441fc3bea13324e
SHA1 178afa3feea3f74a52c116221b8c26a498e68bde
SHA512 09e32d33fca7a9354889d493a1cf0742fa2eab5ef1a3ca204e03f079bf0be8a142f16acfe7cd286f48e3d0b8dc0f5e6cb7ee19d5e343b525201c3e04a9c3e022
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2676	2224	regsvr32.exe	68
PID 2224 wrote to memory of 2676	2224	regsvr32.exe	68
PID 2224 wrote to memory of 2676	2224	regsvr32.exe	68
PID 2676 wrote to memory of 2020	2676	regsvr32.exe	69
PID 2676 wrote to memory of 2020	2676	regsvr32.exe	69
PID 2676 wrote to memory of 2020	2676	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a7652fd0fb951fec53fbfcfc086cc9716c7105dcb45f8bed21e1f95ef0242a95_2022-01-30__000036.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a7652fd0fb951fec53fbfcfc086cc9716c7105dcb45f8bed21e1f95ef0242a95_2022-01-30__000036.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a7652fd0fb951fec53fbfcfc086cc9716c7105dcb45f8bed21e1f95ef0242a95_2022-01-30__000036.dll",DllRegisterServer
    3⤵
    PID:2020