50b9b2adb4f5c2567da226b5c2cd8806a89da7e1cd9ab7055cbc19f2326db5ae

Analysis

Target
emotet_exe_e4_50b9b2adb4f5c2567da226b5c2cd8806a89da7e1cd9ab7055cbc19f2326db5ae_2022-02-02__170955.dll
Size 988KB
Sample220202-vpwr2sdcal
SHA256 50b9b2adb4f5c2567da226b5c2cd8806a89da7e1cd9ab7055cbc19f2326db5ae
MD5 f02bf443fd8c99cb77d8a4a5eca892b8
SHA1 e451569cc49eb1ed9b85f2474d20507b67669bdc
SHA512 923acde33025a91d9424e67f44bf455d3c0fdeb1307ad1a52ccc8e87281dd60a30f7d358fd2b12f1ce04d00c673f3c6d3546e5eb7ead4a4ecb8fb24b45677098
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 4604	4328	regsvr32.exe	82
PID 4328 wrote to memory of 4604	4328	regsvr32.exe	82
PID 4328 wrote to memory of 4604	4328	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_50b9b2adb4f5c2567da226b5c2cd8806a89da7e1cd9ab7055cbc19f2326db5ae_2022-02-02__170955.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_50b9b2adb4f5c2567da226b5c2cd8806a89da7e1cd9ab7055cbc19f2326db5ae_2022-02-02__170955.dll
  2⤵
  PID:4604