ecb44a2bd3bd66c64d7cfd1cad7ac2dedc19992310f5f9bc32cd282c83ddc88e

Analysis

Target
emotet_exe_e4_ecb44a2bd3bd66c64d7cfd1cad7ac2dedc19992310f5f9bc32cd282c83ddc88e_2022-02-06__000330.dll
Size 997KB
Sample220206-acmcmagab3
SHA256 ecb44a2bd3bd66c64d7cfd1cad7ac2dedc19992310f5f9bc32cd282c83ddc88e
MD5 976b33c2949795579663a097746fc380
SHA1 694ee653b8930a84642d208224860835030ad420
SHA512 a16dc79dc82b9aeb017d43e17eba16b47848c763d3ec92c537ab883cf4f48993d233ece69b5f0aa982beae39237ada78dd3fe84bbd88717b356839abf95a32f8
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 4740	312	regsvr32.exe	81
PID 312 wrote to memory of 4740	312	regsvr32.exe	81
PID 312 wrote to memory of 4740	312	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ecb44a2bd3bd66c64d7cfd1cad7ac2dedc19992310f5f9bc32cd282c83ddc88e_2022-02-06__000330.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:312
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_ecb44a2bd3bd66c64d7cfd1cad7ac2dedc19992310f5f9bc32cd282c83ddc88e_2022-02-06__000330.dll
  2⤵
  PID:4740