3c8cc151491c157f5bb44311909feaa726a654229fb6b3c54ba0b686b76f29af

Analysis

Target
emotet_exe_e4_234b03595bffda59665332761a25bd98ba7cdf0496ab550f9b57265ccf916ef5_2022-02-01__214043.dll
Size 716KB
Sample220201-1jsfbsbhep
SHA256 3c8cc151491c157f5bb44311909feaa726a654229fb6b3c54ba0b686b76f29af
MD5 fd578f12b0ad5a9cd2fbdb5061d1243d
SHA1 d342e95323a6ff86d1d07e566c7f32663aab4677
SHA512 10987a21eeb0b88f8b229f2181c9d002833a759f91b75f188bea55fd4646df474882c666e13f51436bd57726b81add3ff41d3eafad9495bb7b22447836108fb8
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1704 wrote to memory of 1880	1704	regsvr32.exe	27
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28
PID 1880 wrote to memory of 524	1880	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_234b03595bffda59665332761a25bd98ba7cdf0496ab550f9b57265ccf916ef5_2022-02-01__214043.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_234b03595bffda59665332761a25bd98ba7cdf0496ab550f9b57265ccf916ef5_2022-02-01__214043.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_234b03595bffda59665332761a25bd98ba7cdf0496ab550f9b57265ccf916ef5_2022-02-01__214043.dll",DllRegisterServer
    3⤵
    PID:524

memory/1704-54-0x000007FEFC441000-0x000007FEFC443000-memory.dmp

Download

memory/1880-55-0x0000000076001000-0x0000000076003000-memory.dmp

Download