9c234df835b0eaba1babbac11cdda7143e592fee87d89b5dc3ed4eec370f5b16

Analysis

Target
emotet_exe_e5_9c234df835b0eaba1babbac11cdda7143e592fee87d89b5dc3ed4eec370f5b16_2022-02-02__041655.dll
Size 546KB
Sample220202-ewdbaafgdn
SHA256 9c234df835b0eaba1babbac11cdda7143e592fee87d89b5dc3ed4eec370f5b16
MD5 64b5ce516bd833a1a80ac74e7a9ffcbf
SHA1 cae78c3a03da21bf8c3e3e232dd6c5b6eb915af2
SHA512 ed90a8fd8ef53efece3c6a40e8bd927948ff9a5bf2837e7b6a1f54979b4ad6c8d9dd0dc17f4f53ae2e5726243b6c92bcf40734b444063daf072d5337167cd24a
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1684 wrote to memory of 1636	1684	regsvr32.exe	27
PID 1636 wrote to memory of 1428	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1428	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1428	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1428	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1428	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1428	1636	regsvr32.exe	28
PID 1636 wrote to memory of 1428	1636	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9c234df835b0eaba1babbac11cdda7143e592fee87d89b5dc3ed4eec370f5b16_2022-02-02__041655.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9c234df835b0eaba1babbac11cdda7143e592fee87d89b5dc3ed4eec370f5b16_2022-02-02__041655.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9c234df835b0eaba1babbac11cdda7143e592fee87d89b5dc3ed4eec370f5b16_2022-02-02__041655.dll",DllRegisterServer
    3⤵
    PID:1428

memory/1636-55-0x0000000076421000-0x0000000076423000-memory.dmp

Download

memory/1684-54-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Download