41d9bcf5b5bf513f128dd81cfd4d8aa05197012ac8ecf89733eb2015c92e3fcd

Analysis

Target
emotet_exe_e4_41d9bcf5b5bf513f128dd81cfd4d8aa05197012ac8ecf89733eb2015c92e3fcd_2022-02-05__000833.dll
Size 997KB
Sample220205-afgljsfheq
SHA256 41d9bcf5b5bf513f128dd81cfd4d8aa05197012ac8ecf89733eb2015c92e3fcd
MD5 29ffa1072d9309d3cc01a929fab7e2de
SHA1 62cc659ab4fd369d16e6f0f95d496d76bf256efa
SHA512 16a4787db9d4036abb324390c4f8b934a64039e20d9a1d15a51c898a342243e33a1ebcc433d6ee11e2218430ae6c68a0960442f4696c417962a5f2ba3cf4b727
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 548	1324	regsvr32.exe	84
PID 1324 wrote to memory of 548	1324	regsvr32.exe	84
PID 1324 wrote to memory of 548	1324	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_41d9bcf5b5bf513f128dd81cfd4d8aa05197012ac8ecf89733eb2015c92e3fcd_2022-02-05__000833.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_41d9bcf5b5bf513f128dd81cfd4d8aa05197012ac8ecf89733eb2015c92e3fcd_2022-02-05__000833.dll
  2⤵
  PID:548