cfcf37a83ff529bc2319019c76994bbd1b9ec5cd8f84bd3ed3876d7a7b94d64b

Analysis

Target
emotet_exe_e5_cfcf37a83ff529bc2319019c76994bbd1b9ec5cd8f84bd3ed3876d7a7b94d64b_2022-03-23__043040.dll
Size 239KB
Sample220323-e5dy6sbfel
SHA256 cfcf37a83ff529bc2319019c76994bbd1b9ec5cd8f84bd3ed3876d7a7b94d64b
MD5 b9508ad70cda3e0efbf04ec905e35222
SHA1 9e571004ae0b24ead1c1047c4e7b84386aba6d3e
SHA512 b1770a373731ff5b46fb5f83acc28ea2e68e26b13fb3391d528689145de9303df555af7d3752a426bc73f4ffec812c1c459b04f48706de262fcda4f47416857c
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1604	1608	rundll32.exe	27
PID 1608 wrote to memory of 1604	1608	rundll32.exe	27
PID 1608 wrote to memory of 1604	1608	rundll32.exe	27
PID 1608 wrote to memory of 1604	1608	rundll32.exe	27
PID 1608 wrote to memory of 1604	1608	rundll32.exe	27
PID 1608 wrote to memory of 1604	1608	rundll32.exe	27
PID 1608 wrote to memory of 1604	1608	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cfcf37a83ff529bc2319019c76994bbd1b9ec5cd8f84bd3ed3876d7a7b94d64b_2022-03-23__043040.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_cfcf37a83ff529bc2319019c76994bbd1b9ec5cd8f84bd3ed3876d7a7b94d64b_2022-03-23__043040.dll,#1
  2⤵
  PID:1604

memory/1604-55-0x0000000076851000-0x0000000076853000-memory.dmp

Download