52b7f2a81a2d04e4f0ff900d8e9a7a7c1f38c405ccaea0408c08e58534d8a3d2

Analysis

Target
emotet_exe_e5_52b7f2a81a2d04e4f0ff900d8e9a7a7c1f38c405ccaea0408c08e58534d8a3d2_2022-02-04__001429.dll
Size 966KB
Sample220204-ajz73aebf5
SHA256 52b7f2a81a2d04e4f0ff900d8e9a7a7c1f38c405ccaea0408c08e58534d8a3d2
MD5 729d5c2367e760ad14cc16740d26ad60
SHA1 06ddbb4d59c2b59d9059ac4fa70777c130e5b197
SHA512 978e592e3d7c3b0656f2b5b7ea13fef15ff4308f4f9fdf304afc10d2cd801a09c738a7658c04a7d8cb8a77a357ad256e44f48c03b6c04b8527ff22e2c1b76a95
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4476	3480	regsvr32.exe	82
PID 3480 wrote to memory of 4476	3480	regsvr32.exe	82
PID 3480 wrote to memory of 4476	3480	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_52b7f2a81a2d04e4f0ff900d8e9a7a7c1f38c405ccaea0408c08e58534d8a3d2_2022-02-04__001429.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_52b7f2a81a2d04e4f0ff900d8e9a7a7c1f38c405ccaea0408c08e58534d8a3d2_2022-02-04__001429.dll
  2⤵
  PID:4476

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe c8465a13ab4597ea5db6142df163f27b XUKIHa4KP0WdUtg8yf/lTA.0.1.0.0.0
1⤵
PID:4536