1ce9fcc2324664863c9049ccfa3cb009c40961c8a870a14c41cfe55d7f940e02

Analysis

Target
emotet_exe_e4_1ce9fcc2324664863c9049ccfa3cb009c40961c8a870a14c41cfe55d7f940e02_2022-02-03__121137.dll
Size 972KB
Sample220203-pc9kgsghhm
SHA256 1ce9fcc2324664863c9049ccfa3cb009c40961c8a870a14c41cfe55d7f940e02
MD5 e0a7bf28b4de2d58deb02186f99efc02
SHA1 a11487254b66ef442b1691445c5bb35f705c56f1
SHA512 1ab222cda6854999c53f0fb622a514904c18b88f9a788517579a8ef718926c33ec4f1a4c7974c672daea955b72401ad2aca0a8054220ba67e3675e4e6db32f1e
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 4420	2792	regsvr32.exe	82
PID 2792 wrote to memory of 4420	2792	regsvr32.exe	82
PID 2792 wrote to memory of 4420	2792	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_1ce9fcc2324664863c9049ccfa3cb009c40961c8a870a14c41cfe55d7f940e02_2022-02-03__121137.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_1ce9fcc2324664863c9049ccfa3cb009c40961c8a870a14c41cfe55d7f940e02_2022-02-03__121137.dll
  2⤵
  PID:4420