9253d0f2d7d052f70ec1f9253869a3b2a7ff7bf458604a93720ec8784e119230

Analysis

Target
emotet_exe_e5_9253d0f2d7d052f70ec1f9253869a3b2a7ff7bf458604a93720ec8784e119230_2022-02-02__204550.dll
Size 979KB
Sample220202-zkbcrsbear
SHA256 9253d0f2d7d052f70ec1f9253869a3b2a7ff7bf458604a93720ec8784e119230
MD5 2336f6a4ca309297070ea735c1840443
SHA1 599e2a1920c096c0f417d46485518680c311bdc5
SHA512 d97a1d91aa85df7720dc0d15a9d9dcef06f813ce39cc5d89f91a36f6803e86578ecfdcf75f68438140434cc489a402389646be8f9360cd577b936e8763423907
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 4872	456	regsvr32.exe	82
PID 456 wrote to memory of 4872	456	regsvr32.exe	82
PID 456 wrote to memory of 4872	456	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9253d0f2d7d052f70ec1f9253869a3b2a7ff7bf458604a93720ec8784e119230_2022-02-02__204550.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_9253d0f2d7d052f70ec1f9253869a3b2a7ff7bf458604a93720ec8784e119230_2022-02-02__204550.dll
  2⤵
  PID:4872