00f63d6dfd2ccc753b221ed316a18c2de03b8100c795207fe4f014c7417ff183

Analysis

Target
emotet_exe_e4_00f63d6dfd2ccc753b221ed316a18c2de03b8100c795207fe4f014c7417ff183_2022-02-04__000912.dll
Size 977KB
Sample220204-af3h1seebp
SHA256 00f63d6dfd2ccc753b221ed316a18c2de03b8100c795207fe4f014c7417ff183
MD5 706adaf1ed7ea33c2e136086a3bedffa
SHA1 ff5b409a7128939d1cceb33cfbf9b3832a6fecd5
SHA512 48a36d572ec1d2cc8d33e8146a5d73078dbd63f5ee606107fb53a89603499ffc784be9cf4226af9698c4b84d0d49f8e997c5baab83cb2813a6a618dabe24c83c
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 4072	1052	regsvr32.exe	82
PID 1052 wrote to memory of 4072	1052	regsvr32.exe	82
PID 1052 wrote to memory of 4072	1052	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_00f63d6dfd2ccc753b221ed316a18c2de03b8100c795207fe4f014c7417ff183_2022-02-04__000912.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_00f63d6dfd2ccc753b221ed316a18c2de03b8100c795207fe4f014c7417ff183_2022-02-04__000912.dll
  2⤵
  PID:4072