077b41e18df4a8a21fb0644bb0b005f8ee491a4a489d9ce71a017aa4fa0f1b1a

Analysis

Target
emotet_exe_e5_077b41e18df4a8a21fb0644bb0b005f8ee491a4a489d9ce71a017aa4fa0f1b1a_2022-01-30__020923.dll
Size 544KB
Sample220130-clqgradbhp
SHA256 077b41e18df4a8a21fb0644bb0b005f8ee491a4a489d9ce71a017aa4fa0f1b1a
MD5 8b5d22253ae0695b99b5f9ad83cc581d
SHA1 d668a3e11d2b531d99a1a8040b946b0465ee3c7d
SHA512 68d30a5d8ee8e44c2834fce27a03bfd67329e15dc932a90afea257270d5a191653e4e1b67b26cd9ef4cb0dcb3de560505d706fda4a62010a0cf88a5f5e03889b
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 3880	3584	regsvr32.exe	69
PID 3584 wrote to memory of 3880	3584	regsvr32.exe	69
PID 3584 wrote to memory of 3880	3584	regsvr32.exe	69
PID 3880 wrote to memory of 1360	3880	regsvr32.exe	70
PID 3880 wrote to memory of 1360	3880	regsvr32.exe	70
PID 3880 wrote to memory of 1360	3880	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_077b41e18df4a8a21fb0644bb0b005f8ee491a4a489d9ce71a017aa4fa0f1b1a_2022-01-30__020923.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_077b41e18df4a8a21fb0644bb0b005f8ee491a4a489d9ce71a017aa4fa0f1b1a_2022-01-30__020923.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_077b41e18df4a8a21fb0644bb0b005f8ee491a4a489d9ce71a017aa4fa0f1b1a_2022-01-30__020923.dll",DllRegisterServer
    3⤵
    PID:1360