3b27122616212a406e54e8ddfa9726d3e744388a3afcb23a0c664591a09c88ef

Analysis

Target
emotet_exe_e5_3b27122616212a406e54e8ddfa9726d3e744388a3afcb23a0c664591a09c88ef_2022-02-03__201441.dll
Size 982KB
Sample220203-y1pdwsdear
SHA256 3b27122616212a406e54e8ddfa9726d3e744388a3afcb23a0c664591a09c88ef
MD5 c8579c99f3f77bbb7b19cad66c4ca020
SHA1 5a882a05f1ba67e05ee74d2ffcbd536313fb2756
SHA512 d61044c3cd4a7d7432740d4cc4ab607d99aed0bf11018b8b82ca7a812ffc2b414be11ccf3ede7c70813bbd2777e2c72fec0b2529e9eaaa4dbb6be059215751a1
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2796	2576	regsvr32.exe	82
PID 2576 wrote to memory of 2796	2576	regsvr32.exe	82
PID 2576 wrote to memory of 2796	2576	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3b27122616212a406e54e8ddfa9726d3e744388a3afcb23a0c664591a09c88ef_2022-02-03__201441.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_3b27122616212a406e54e8ddfa9726d3e744388a3afcb23a0c664591a09c88ef_2022-02-03__201441.dll
  2⤵
  PID:2796