006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60

Analysis

Target
emotet_exe_e4_006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60_2022-01-30__000105.dll
Size 538KB
Sample220130-abgezscdc7
SHA256 006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60
MD5 3b884af02c4eab3fea2760d227e87f3b
SHA1 9a7aacf9bfaaaf6ba332b87ab67e12b5a312ee74
SHA512 aecb838c8d3415a90ba25ef27fc4df6cde27a068ec5727fe032a6b93cf193cfb5c873babf1a23965961d6b86bf8d143981c43394ab09fedf00e5797b5533fd5d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 320	828	regsvr32.exe	27
PID 828 wrote to memory of 320	828	regsvr32.exe	27
PID 828 wrote to memory of 320	828	regsvr32.exe	27
PID 828 wrote to memory of 320	828	regsvr32.exe	27
PID 828 wrote to memory of 320	828	regsvr32.exe	27
PID 828 wrote to memory of 320	828	regsvr32.exe	27
PID 828 wrote to memory of 320	828	regsvr32.exe	27
PID 320 wrote to memory of 580	320	regsvr32.exe	28
PID 320 wrote to memory of 580	320	regsvr32.exe	28
PID 320 wrote to memory of 580	320	regsvr32.exe	28
PID 320 wrote to memory of 580	320	regsvr32.exe	28
PID 320 wrote to memory of 580	320	regsvr32.exe	28
PID 320 wrote to memory of 580	320	regsvr32.exe	28
PID 320 wrote to memory of 580	320	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60_2022-01-30__000105.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60_2022-01-30__000105.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_006f3385b62788fc782e40a68438d0ea2ab87bcc13e9ce6fcceb9d43da5d8e60_2022-01-30__000105.dll",DllRegisterServer
    3⤵
    PID:580

memory/320-55-0x0000000076071000-0x0000000076073000-memory.dmp

Download

memory/828-54-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Download