311174c941f3a931391c2c81b7a4aef416f2cbf291a6432a0aff39190b10c521

Analysis

Target
emotet_exe_e5_311174c941f3a931391c2c81b7a4aef416f2cbf291a6432a0aff39190b10c521_2022-02-03__174437.dll
Size 324KB
Sample220203-wbtwzaceh4
SHA256 311174c941f3a931391c2c81b7a4aef416f2cbf291a6432a0aff39190b10c521
MD5 1e60b69235c42c7b2e304db9701ff5c9
SHA1 c1aa570aa93da61fa874ce38f0180ad0f99ff7c8
SHA512 dc4b00954f8f70903d518cf15c09752d3bb48d470d5f3f8bd765d91d3111a7566a2bcd1cb051136824f38d211cd72caa0c4d8bf0e57d3b2ce07ce28b91c2697e
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2456	2308	regsvr32.exe	82
PID 2308 wrote to memory of 2456	2308	regsvr32.exe	82
PID 2308 wrote to memory of 2456	2308	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_311174c941f3a931391c2c81b7a4aef416f2cbf291a6432a0aff39190b10c521_2022-02-03__174437.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_311174c941f3a931391c2c81b7a4aef416f2cbf291a6432a0aff39190b10c521_2022-02-03__174437.dll
  2⤵
  PID:2456