8811e7fd6e635d16fec8133fde53bf60f019c9ef167e1ec216ccb7f69e7b2e3f

Analysis

Target
emotet_exe_e5_8811e7fd6e635d16fec8133fde53bf60f019c9ef167e1ec216ccb7f69e7b2e3f_2022-02-03__211536.dll
Size 966KB
Sample220203-z4pphaeafk
SHA256 8811e7fd6e635d16fec8133fde53bf60f019c9ef167e1ec216ccb7f69e7b2e3f
MD5 afd400d2961da663b23c1940588bd69d
SHA1 07965612a45a8a4efd814c130d9c32276d19721c
SHA512 a3cfcf5563dc7d937c5ad3ec4dcecd082f22b38ff7476d58c1032a98ff0fd2f17b6e3d530a32061e26f8e06ea0061e41e77c6577568b7b2a048206b1e5135b48
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4516	4800	regsvr32.exe	82
PID 4800 wrote to memory of 4516	4800	regsvr32.exe	82
PID 4800 wrote to memory of 4516	4800	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8811e7fd6e635d16fec8133fde53bf60f019c9ef167e1ec216ccb7f69e7b2e3f_2022-02-03__211536.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_8811e7fd6e635d16fec8133fde53bf60f019c9ef167e1ec216ccb7f69e7b2e3f_2022-02-03__211536.dll
  2⤵
  PID:4516