40d73e8564c87f72d8d14f07807cb1aa61dec4b1fc856987382d07a4e9aa8968

Analysis

Target
emotet_exe_e5_40d73e8564c87f72d8d14f07807cb1aa61dec4b1fc856987382d07a4e9aa8968_2022-02-03__211536.dll
Size 966KB
Sample220203-z4pphaeafm
SHA256 40d73e8564c87f72d8d14f07807cb1aa61dec4b1fc856987382d07a4e9aa8968
MD5 37fb2d973705b1dad0ba3a061283745f
SHA1 302053a2b021539aea949d4d5881d06658d1f6cd
SHA512 9cce9803cf8ddebcb76bd2ce23a42c9ee5f2e8704946f48bf68da1ebe3eea8467f65d446677e379999e67c2acf46ef4f8cd9625be6cc688b5294d32386608212
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4244	3976	regsvr32.exe	82
PID 3976 wrote to memory of 4244	3976	regsvr32.exe	82
PID 3976 wrote to memory of 4244	3976	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_40d73e8564c87f72d8d14f07807cb1aa61dec4b1fc856987382d07a4e9aa8968_2022-02-03__211536.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_40d73e8564c87f72d8d14f07807cb1aa61dec4b1fc856987382d07a4e9aa8968_2022-02-03__211536.dll
  2⤵
  PID:4244