2214dfc8365466735509e6c6d04513be4e8997d8608de9c829035e597237bb47

Analysis

Target
emotet_exe_e4_2214dfc8365466735509e6c6d04513be4e8997d8608de9c829035e597237bb47_2022-02-02__170957.dll
Size 988KB
Sample220202-vpwr2sdcan
SHA256 2214dfc8365466735509e6c6d04513be4e8997d8608de9c829035e597237bb47
MD5 a90068f5e03507be372e0a7485f6c381
SHA1 d0de2bfeadef16e863f6487e7df2695fd626fc75
SHA512 664c8521b3dcdaff049a2b3db25e05d7253b9c0b393b4ebbe91a0a623b2c6d7c074e1eff5b3a1006b63e22cb668335c8c542d22e1807ee017521e507bdbd329a
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2768	2716	regsvr32.exe	82
PID 2716 wrote to memory of 2768	2716	regsvr32.exe	82
PID 2716 wrote to memory of 2768	2716	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2214dfc8365466735509e6c6d04513be4e8997d8608de9c829035e597237bb47_2022-02-02__170957.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_2214dfc8365466735509e6c6d04513be4e8997d8608de9c829035e597237bb47_2022-02-02__170957.dll
  2⤵
  PID:2768