89d737133357572e7782573fb0ea03d9e6c1ce080ab62e34edea7ab17f18db6a

Analysis

Target
emotet_exe_e4_89d737133357572e7782573fb0ea03d9e6c1ce080ab62e34edea7ab17f18db6a_2022-02-03__000121.dll
Size 988KB
Sample220203-abldyacdek
SHA256 89d737133357572e7782573fb0ea03d9e6c1ce080ab62e34edea7ab17f18db6a
MD5 2ffc76d58164ff4ea9e2e60e30d15cd4
SHA1 2a736ad4a4c1a1a3741c974efbe247b95552dccb
SHA512 27f63434f6c2f0dde0697f8cadfb054a92acb669e149c3fc856df388d17c09456c93c7eacd5e6f55b0bd961cb5fa1fd293a5ff4eb5db07a390a84447ccca5925
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 3424	5056	regsvr32.exe	82
PID 5056 wrote to memory of 3424	5056	regsvr32.exe	82
PID 5056 wrote to memory of 3424	5056	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_89d737133357572e7782573fb0ea03d9e6c1ce080ab62e34edea7ab17f18db6a_2022-02-03__000121.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_89d737133357572e7782573fb0ea03d9e6c1ce080ab62e34edea7ab17f18db6a_2022-02-03__000121.dll
  2⤵
  PID:3424