4f784059e4bd003771ec79cf65451811c6484ca7967600c98589c7c01ea9d217

Analysis

Target
emotet_exe_e4_4f784059e4bd003771ec79cf65451811c6484ca7967600c98589c7c01ea9d217_2022-02-07__181953.dll
Size 1.4MB
Sample220207-wysmesfch8
SHA256 4f784059e4bd003771ec79cf65451811c6484ca7967600c98589c7c01ea9d217
MD5 c7cad7e76a58e122197829bc6f473808
SHA1 9bfd43530eaa18d4fe9fa0557cf7db478cbdeaa4
SHA512 daa1928f22ae42ab3fc9f7c59e2a8e7e937a7ed384bf7f09e7170bd2e5fdea3da0ec0acfd54c22c7fc27ecfbfbb51c4358d2b71d7e8745d963f89f96d6997701
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 3596	3420	regsvr32.exe	82
PID 3420 wrote to memory of 3596	3420	regsvr32.exe	82
PID 3420 wrote to memory of 3596	3420	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4f784059e4bd003771ec79cf65451811c6484ca7967600c98589c7c01ea9d217_2022-02-07__181953.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_4f784059e4bd003771ec79cf65451811c6484ca7967600c98589c7c01ea9d217_2022-02-07__181953.dll
  2⤵
  PID:3596