3637a82f83f6a27415e03d48cf5a606763dade35ed3eb748c29c62868ed44fa2

Analysis

Target
emotet_exe_e4_3637a82f83f6a27415e03d48cf5a606763dade35ed3eb748c29c62868ed44fa2_2022-02-04__000907.dll
Size 977KB
Sample220204-af279aebc6
SHA256 3637a82f83f6a27415e03d48cf5a606763dade35ed3eb748c29c62868ed44fa2
MD5 bfc0b078b958f18d1472183325470d2f
SHA1 2b62354047ad63f31219ed5fe81ab807061b69b2
SHA512 600a6eebcf14900725a058c67ec4659b7b65eef102b2a933f6ad29f7c68609a41bff5670be7690a714c47cb93a7b4dba989b4d0240dd934f2392006814e4762e
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 2008	1352	regsvr32.exe	27
PID 1352 wrote to memory of 2008	1352	regsvr32.exe	27
PID 1352 wrote to memory of 2008	1352	regsvr32.exe	27
PID 1352 wrote to memory of 2008	1352	regsvr32.exe	27
PID 1352 wrote to memory of 2008	1352	regsvr32.exe	27
PID 1352 wrote to memory of 2008	1352	regsvr32.exe	27
PID 1352 wrote to memory of 2008	1352	regsvr32.exe	27
PID 2008 wrote to memory of 2004	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2004	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2004	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2004	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2004	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2004	2008	regsvr32.exe	28
PID 2008 wrote to memory of 2004	2008	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3637a82f83f6a27415e03d48cf5a606763dade35ed3eb748c29c62868ed44fa2_2022-02-04__000907.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3637a82f83f6a27415e03d48cf5a606763dade35ed3eb748c29c62868ed44fa2_2022-02-04__000907.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3637a82f83f6a27415e03d48cf5a606763dade35ed3eb748c29c62868ed44fa2_2022-02-04__000907.dll",DllRegisterServer
    3⤵
    PID:2004

memory/1352-55-0x000007FEFB791000-0x000007FEFB793000-memory.dmp

Download

memory/2008-56-0x0000000075021000-0x0000000075023000-memory.dmp

Download

memory/2008-57-0x0000000000230000-0x00000000002B0000-memory.dmp

Download