6a811884c95f9df4c24bf64c9f0a117f2ed9b31d27afd3c2c56978fcf208e003

Analysis

Target
emotet_exe_e4_6a811884c95f9df4c24bf64c9f0a117f2ed9b31d27afd3c2c56978fcf208e003_2022-02-03__191053.dll
Size 977KB
Sample220203-xv9bfadcck
SHA256 6a811884c95f9df4c24bf64c9f0a117f2ed9b31d27afd3c2c56978fcf208e003
MD5 d13a248885a627055e02ab1dec7c4714
SHA1 1821eedad2121649587601ea6ff7d0d81ec992be
SHA512 33b2b04e78416989f841d84d791078987caf0b2bec878745305acfbbb3fb49370a0ad5db34dcfedef08598b2ed6c2cee0b0cc756aca54695ea0ea4a512b8d814
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4628	4316	regsvr32.exe	81
PID 4316 wrote to memory of 4628	4316	regsvr32.exe	81
PID 4316 wrote to memory of 4628	4316	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6a811884c95f9df4c24bf64c9f0a117f2ed9b31d27afd3c2c56978fcf208e003_2022-02-03__191053.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_6a811884c95f9df4c24bf64c9f0a117f2ed9b31d27afd3c2c56978fcf208e003_2022-02-03__191053.dll
  2⤵
  PID:4628