d584f6e7655c0c5a101e2b14f994cb5e84ece8624cdabeca9cad670a49556591

Analysis

Target
emotet_exe_e5_d584f6e7655c0c5a101e2b14f994cb5e84ece8624cdabeca9cad670a49556591_2022-02-02__000514.dll
Size 520KB
Sample220202-adthbsdfb3
SHA256 d584f6e7655c0c5a101e2b14f994cb5e84ece8624cdabeca9cad670a49556591
MD5 42d6be3fb40332f8fd4f8c24f168169e
SHA1 97f0706a00701ecd38d1dd68b587a330bb7d0055
SHA512 4ad09cb896a05086e73ecd89dc30a89a44ee32ca542cc933f4400ff3592dc0310001e90f09271e53ef339d3f4ff7b48abc45413a3a026189146d27e2a885cdbc
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 952	828	regsvr32.exe	27
PID 828 wrote to memory of 952	828	regsvr32.exe	27
PID 828 wrote to memory of 952	828	regsvr32.exe	27
PID 828 wrote to memory of 952	828	regsvr32.exe	27
PID 828 wrote to memory of 952	828	regsvr32.exe	27
PID 828 wrote to memory of 952	828	regsvr32.exe	27
PID 828 wrote to memory of 952	828	regsvr32.exe	27
PID 952 wrote to memory of 652	952	regsvr32.exe	28
PID 952 wrote to memory of 652	952	regsvr32.exe	28
PID 952 wrote to memory of 652	952	regsvr32.exe	28
PID 952 wrote to memory of 652	952	regsvr32.exe	28
PID 952 wrote to memory of 652	952	regsvr32.exe	28
PID 952 wrote to memory of 652	952	regsvr32.exe	28
PID 952 wrote to memory of 652	952	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d584f6e7655c0c5a101e2b14f994cb5e84ece8624cdabeca9cad670a49556591_2022-02-02__000514.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d584f6e7655c0c5a101e2b14f994cb5e84ece8624cdabeca9cad670a49556591_2022-02-02__000514.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_d584f6e7655c0c5a101e2b14f994cb5e84ece8624cdabeca9cad670a49556591_2022-02-02__000514.dll",DllRegisterServer
    3⤵
    PID:652

memory/828-55-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Download

memory/952-56-0x0000000075D61000-0x0000000075D63000-memory.dmp

Download