03bd4a92c7510ced62ceb13642804516f4e505ae9f96287b7bd38e89d9ecf3e7

Analysis

Target
emotet_exe_e5_03bd4a92c7510ced62ceb13642804516f4e505ae9f96287b7bd38e89d9ecf3e7_2022-03-25__030348.dll
Size 639KB
Sample220325-dklylsfacn
SHA256 03bd4a92c7510ced62ceb13642804516f4e505ae9f96287b7bd38e89d9ecf3e7
MD5 aac899f32269fcf7d9c64019c6dfc373
SHA1 473884b95eddfd2dc551920205c16dd2d9c8c3e5
SHA512 7670ad1b8d44f3d5748d5bbac7b807b3e0ad45292f3f0c6b969180a88b1f0adfb2f3ffaa98d44b579ca7de10d4329c8593b4a3d2f88228522e5d1e587c8ef1d8
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27
PID 2016 wrote to memory of 1356	2016	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_03bd4a92c7510ced62ceb13642804516f4e505ae9f96287b7bd38e89d9ecf3e7_2022-03-25__030348.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_03bd4a92c7510ced62ceb13642804516f4e505ae9f96287b7bd38e89d9ecf3e7_2022-03-25__030348.dll
  2⤵
  PID:1356

memory/1356-56-0x0000000075D31000-0x0000000075D33000-memory.dmp

Download

memory/2016-54-0x000007FEFBE31000-0x000007FEFBE33000-memory.dmp

Download