9bfc11d4d58daeaa2daa9ff378009d62248ed3503c977ba45feee8b90d3facd6

Analysis

Target
emotet_exe_e4_9bfc11d4d58daeaa2daa9ff378009d62248ed3503c977ba45feee8b90d3facd6_2022-02-02__170955.dll
Size 988KB
Sample220202-vpwr2sdcak
SHA256 9bfc11d4d58daeaa2daa9ff378009d62248ed3503c977ba45feee8b90d3facd6
MD5 d89a2520e0d2e75dba7a5a5bbcff5275
SHA1 c9025666b39317e27e131dab06f5550cfc9fadf9
SHA512 74b69e3aeb2b8fba75adadd5274407dae76b1fd23b03c2fdcdf0053b4a0a4cb8612380ce5e33828ee70e74810efbb735fbbbff9158de13d9b83431af409efdec
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4984	3180	regsvr32.exe	82
PID 3180 wrote to memory of 4984	3180	regsvr32.exe	82
PID 3180 wrote to memory of 4984	3180	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9bfc11d4d58daeaa2daa9ff378009d62248ed3503c977ba45feee8b90d3facd6_2022-02-02__170955.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9bfc11d4d58daeaa2daa9ff378009d62248ed3503c977ba45feee8b90d3facd6_2022-02-02__170955.dll
  2⤵
  PID:4984