ca1a40524618d80c3a8d3b12b11a03af0bf7b7810e9e05c7b85b8a2b73d2fa93

Analysis

Target
emotet_exe_e4_ca1a40524618d80c3a8d3b12b11a03af0bf7b7810e9e05c7b85b8a2b73d2fa93_2022-02-03__121141.dll
Size 972KB
Sample220203-pc89qaghhj
SHA256 ca1a40524618d80c3a8d3b12b11a03af0bf7b7810e9e05c7b85b8a2b73d2fa93
MD5 a4fa7c4017755d90c7e677478a07d280
SHA1 7bf2c4c9676580ca7d165eb79e357c88c69df929
SHA512 fa30813e42a6b7622cdec0e04ba1f37f33d219023016ab59d6f867c15b9fbfa006a9b6477d716fd51bd5537aebd9302511e66d0bcced50565f495330db764be7
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 2684	4256	regsvr32.exe	82
PID 4256 wrote to memory of 2684	4256	regsvr32.exe	82
PID 4256 wrote to memory of 2684	4256	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ca1a40524618d80c3a8d3b12b11a03af0bf7b7810e9e05c7b85b8a2b73d2fa93_2022-02-03__121141.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ca1a40524618d80c3a8d3b12b11a03af0bf7b7810e9e05c7b85b8a2b73d2fa93_2022-02-03__121141.dll
  2⤵
  PID:2684