48afc2042d1498db0ea8e076dd0b121fff526e4c4096adbb19641cbe609938ef

Analysis

Target
emotet_exe_e4_48afc2042d1498db0ea8e076dd0b121fff526e4c4096adbb19641cbe609938ef_2022-02-02__000255.dll
Size 684KB
Sample220202-ab61msdcep
SHA256 48afc2042d1498db0ea8e076dd0b121fff526e4c4096adbb19641cbe609938ef
MD5 e7ee2dcb74b40d7c1d212e7513d2afcc
SHA1 dbf7c045c2d33e64dac1524916d138e075b82d48
SHA512 769724cdfc22474bfbf7743c6844d52e1ba8cdc277bf5569477407961e2f111107a07f1ff03f71e37dc69bfdc491154669fd77249024563f8ebdeee9d122cd2c
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1520 wrote to memory of 1528	1520	regsvr32.exe	27
PID 1528 wrote to memory of 760	1528	regsvr32.exe	28
PID 1528 wrote to memory of 760	1528	regsvr32.exe	28
PID 1528 wrote to memory of 760	1528	regsvr32.exe	28
PID 1528 wrote to memory of 760	1528	regsvr32.exe	28
PID 1528 wrote to memory of 760	1528	regsvr32.exe	28
PID 1528 wrote to memory of 760	1528	regsvr32.exe	28
PID 1528 wrote to memory of 760	1528	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_48afc2042d1498db0ea8e076dd0b121fff526e4c4096adbb19641cbe609938ef_2022-02-02__000255.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_48afc2042d1498db0ea8e076dd0b121fff526e4c4096adbb19641cbe609938ef_2022-02-02__000255.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_48afc2042d1498db0ea8e076dd0b121fff526e4c4096adbb19641cbe609938ef_2022-02-02__000255.dll",DllRegisterServer
    3⤵
    PID:760

memory/1520-55-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Download

memory/1528-56-0x0000000076371000-0x0000000076373000-memory.dmp

Download