22d9f80038e7b1bbcbb5f7aae007a2865720e49de8bc1ca6516988855e19f0ad

Analysis

Target
emotet_exe_e4_22d9f80038e7b1bbcbb5f7aae007a2865720e49de8bc1ca6516988855e19f0ad_2022-02-05__000833.dll
Size 997KB
Sample220205-afgljsfff9
SHA256 22d9f80038e7b1bbcbb5f7aae007a2865720e49de8bc1ca6516988855e19f0ad
MD5 d654e0b99540880a6f1b692e9f0fce8f
SHA1 fddb1393b94f2e15d676f5c93986a4f09f97d36e
SHA512 a06c8a7519a13c56ffa7ad31cbfc7818a1a1172b5183bde44018983b4433c1aee5bc1417dff9359547e26765d43fd6155275638ecd9299ba2f6a08d7ffd960be
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1992 wrote to memory of 1492	1992	regsvr32.exe	27
PID 1492 wrote to memory of 1456	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1456	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1456	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1456	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1456	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1456	1492	regsvr32.exe	28
PID 1492 wrote to memory of 1456	1492	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_22d9f80038e7b1bbcbb5f7aae007a2865720e49de8bc1ca6516988855e19f0ad_2022-02-05__000833.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_22d9f80038e7b1bbcbb5f7aae007a2865720e49de8bc1ca6516988855e19f0ad_2022-02-05__000833.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_22d9f80038e7b1bbcbb5f7aae007a2865720e49de8bc1ca6516988855e19f0ad_2022-02-05__000833.dll",DllRegisterServer
    3⤵
    PID:1456

memory/1492-56-0x0000000076731000-0x0000000076733000-memory.dmp

Download

memory/1992-55-0x000007FEFBE21000-0x000007FEFBE23000-memory.dmp

Download