9e2f2bf0e3621587767c271c9ad68029be6e2bc370454890323b74e35e482fa9

Analysis

Target
emotet_exe_e4_9e2f2bf0e3621587767c271c9ad68029be6e2bc370454890323b74e35e482fa9_2022-02-03__000120.dll
Size 988KB
Sample220203-abldyaceb4
SHA256 9e2f2bf0e3621587767c271c9ad68029be6e2bc370454890323b74e35e482fa9
MD5 ca03638fb30d38e8452c0a2bb2add0f7
SHA1 bbddb52d9b9627594395819aea663361f4488323
SHA512 47a2d095793ca68248bffceba641c34c0ca542885502fd0600a566ed616ad0eb84344ef38d7268ca4393594363afaa6f54f7df2e7528dbd0f85919fd55e92ed0
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 4064	3828	regsvr32.exe	82
PID 3828 wrote to memory of 4064	3828	regsvr32.exe	82
PID 3828 wrote to memory of 4064	3828	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9e2f2bf0e3621587767c271c9ad68029be6e2bc370454890323b74e35e482fa9_2022-02-03__000120.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_9e2f2bf0e3621587767c271c9ad68029be6e2bc370454890323b74e35e482fa9_2022-02-03__000120.dll
  2⤵
  PID:4064

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe e77ff3b5ef6dda220debbbd3492b0f3b 7vJ8eC2YoUWhRxH4VPnBEQ.0.1.0.0.0
1⤵
PID:2944