7913816e7fbb84996d87baf05cb7892b33e49f16e60050d6c28e4a6cebcf00af

Analysis

Target
emotet_exe_e4_7913816e7fbb84996d87baf05cb7892b33e49f16e60050d6c28e4a6cebcf00af_2022-02-03__191052.dll
Size 977KB
Sample220203-xv9bfadaa3
SHA256 7913816e7fbb84996d87baf05cb7892b33e49f16e60050d6c28e4a6cebcf00af
MD5 236f10265f031c8303ccf834da2fe481
SHA1 6eb685743ef78ff8cf88a224f0aff632742a14ae
SHA512 9fdf3d5947ac42b1d1e170c6e52e9e060f307ab62cc63fe2def5fd9ecc53044d7269ef715855cb3b1355cf1c31be90b3abe104b1f51b9d4f9d94e9cd5ebeadd7
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4628	4660	regsvr32.exe	81
PID 4660 wrote to memory of 4628	4660	regsvr32.exe	81
PID 4660 wrote to memory of 4628	4660	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7913816e7fbb84996d87baf05cb7892b33e49f16e60050d6c28e4a6cebcf00af_2022-02-03__191052.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_7913816e7fbb84996d87baf05cb7892b33e49f16e60050d6c28e4a6cebcf00af_2022-02-03__191052.dll
  2⤵
  PID:4628