99c8ca8e201f33875b30d7d05c6d5759fb04a7b9ea9f2ba1e390cbc442e70bbb

Analysis

Target
emotet_exe_e5_99c8ca8e201f33875b30d7d05c6d5759fb04a7b9ea9f2ba1e390cbc442e70bbb_2022-02-04__001432.dll
Size 966KB
Sample220204-ajz73aeegl
SHA256 99c8ca8e201f33875b30d7d05c6d5759fb04a7b9ea9f2ba1e390cbc442e70bbb
MD5 2464fedd358b1f7ff1ae291f2da8ab25
SHA1 d5491c8a11aad124381c4c5dcab0de0f8696e3cb
SHA512 70d22d4e1a740e6d5dba6136783fb4b54ab047b4f1e971292cd8b05a8c6a0672215d5293bc5111d695c8293583f2d474c704bfbb0691997139400a03d1be44c3
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2596	2344	regsvr32.exe	81
PID 2344 wrote to memory of 2596	2344	regsvr32.exe	81
PID 2344 wrote to memory of 2596	2344	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_99c8ca8e201f33875b30d7d05c6d5759fb04a7b9ea9f2ba1e390cbc442e70bbb_2022-02-04__001432.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_99c8ca8e201f33875b30d7d05c6d5759fb04a7b9ea9f2ba1e390cbc442e70bbb_2022-02-04__001432.dll
  2⤵
  PID:2596