3637a82f83f6a27415e03d48cf5a606763dade35ed3eb748c29c62868ed44fa2

Analysis

Target
emotet_exe_e4_3637a82f83f6a27415e03d48cf5a606763dade35ed3eb748c29c62868ed44fa2_2022-02-04__000907.dll
Size 977KB
Sample220204-af279aebc6
SHA256 3637a82f83f6a27415e03d48cf5a606763dade35ed3eb748c29c62868ed44fa2
MD5 bfc0b078b958f18d1472183325470d2f
SHA1 2b62354047ad63f31219ed5fe81ab807061b69b2
SHA512 600a6eebcf14900725a058c67ec4659b7b65eef102b2a933f6ad29f7c68609a41bff5670be7690a714c47cb93a7b4dba989b4d0240dd934f2392006814e4762e
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4888	3048	regsvr32.exe	81
PID 3048 wrote to memory of 4888	3048	regsvr32.exe	81
PID 3048 wrote to memory of 4888	3048	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3637a82f83f6a27415e03d48cf5a606763dade35ed3eb748c29c62868ed44fa2_2022-02-04__000907.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_3637a82f83f6a27415e03d48cf5a606763dade35ed3eb748c29c62868ed44fa2_2022-02-04__000907.dll
  2⤵
  PID:4888