3e9f5026d37b68e98ca63d11b87b810404e5fb9abf5376932cc811469d3937e4

Analysis

Target
emotet_exe_e4_3e9f5026d37b68e98ca63d11b87b810404e5fb9abf5376932cc811469d3937e4_2022-02-03__161559.dll
Size 633KB
Sample220203-treqwabfc2
SHA256 3e9f5026d37b68e98ca63d11b87b810404e5fb9abf5376932cc811469d3937e4
MD5 faf28bf95485debc8b793de385698c18
SHA1 8987a199210c783f393995991fd7724b0f5f16e2
SHA512 dfbb2d3b9059e68dc745c5a56718ed5941e67596790d82b74c558e17a0da8f14c1a311de6297524e0f73ba30173bb3ae08ab05cd4d6836b5e4688dde35aaae39
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1408	1528	regsvr32.exe	27
PID 1528 wrote to memory of 1408	1528	regsvr32.exe	27
PID 1528 wrote to memory of 1408	1528	regsvr32.exe	27
PID 1528 wrote to memory of 1408	1528	regsvr32.exe	27
PID 1528 wrote to memory of 1408	1528	regsvr32.exe	27
PID 1528 wrote to memory of 1408	1528	regsvr32.exe	27
PID 1528 wrote to memory of 1408	1528	regsvr32.exe	27
PID 1408 wrote to memory of 1548	1408	regsvr32.exe	30
PID 1408 wrote to memory of 1548	1408	regsvr32.exe	30
PID 1408 wrote to memory of 1548	1408	regsvr32.exe	30
PID 1408 wrote to memory of 1548	1408	regsvr32.exe	30
PID 1408 wrote to memory of 1548	1408	regsvr32.exe	30
PID 1408 wrote to memory of 1548	1408	regsvr32.exe	30
PID 1408 wrote to memory of 1548	1408	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3e9f5026d37b68e98ca63d11b87b810404e5fb9abf5376932cc811469d3937e4_2022-02-03__161559.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3e9f5026d37b68e98ca63d11b87b810404e5fb9abf5376932cc811469d3937e4_2022-02-03__161559.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3e9f5026d37b68e98ca63d11b87b810404e5fb9abf5376932cc811469d3937e4_2022-02-03__161559.dll",DllRegisterServer
    3⤵
    PID:1548

memory/1408-55-0x0000000076491000-0x0000000076493000-memory.dmp

Download

memory/1528-54-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

Download