fefc79419499d4f758590552befef4872316d76b5a016ed741c00a5266456988

Analysis

Target
emotet_exe_e4_fefc79419499d4f758590552befef4872316d76b5a016ed741c00a5266456988_2022-02-07__181955.dll
Size 1.4MB
Sample220207-wysmesfcaq
SHA256 fefc79419499d4f758590552befef4872316d76b5a016ed741c00a5266456988
MD5 04b05d08bc1dde8b96d4503d3c67b8ac
SHA1 27650cdee12588443e7fb69b58788e45ef07193c
SHA512 d6406b26df96199161287a3871c174f427f43eb2f14aa183cfb2330419969a4c4a7a86bd7d995258f303ce59f15cd28e94c3089186ea3051f239d041aed641f3
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3652	4580	regsvr32.exe	82
PID 4580 wrote to memory of 3652	4580	regsvr32.exe	82
PID 4580 wrote to memory of 3652	4580	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_fefc79419499d4f758590552befef4872316d76b5a016ed741c00a5266456988_2022-02-07__181955.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_fefc79419499d4f758590552befef4872316d76b5a016ed741c00a5266456988_2022-02-07__181955.dll
  2⤵
  PID:3652