64f1d34a5d9953e321a81aa8627c27a8c673ca2a2c9ffacabcb0bdd317502fa2

Analysis

Target
emotet_exe_e5_64f1d34a5d9953e321a81aa8627c27a8c673ca2a2c9ffacabcb0bdd317502fa2_2022-03-26__034852.dll
Size 687KB
Sample220326-edcl2acgbp
SHA256 64f1d34a5d9953e321a81aa8627c27a8c673ca2a2c9ffacabcb0bdd317502fa2
MD5 d5b33680c2c58e0cfe160ae0c22d616d
SHA1 9b9020c88fb649d5789eb7b5470fff4f766e4938
SHA512 ecb1913bb64e7b3b415063d648b5cd65bf9e7a4950a5ad3de4b987eb14015a22f88ba982c8192c53d7417ea4a8ccac19519c61293e1826ea369e726cfc05f555
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 648	4768	regsvr32.exe	83
PID 4768 wrote to memory of 648	4768	regsvr32.exe	83
PID 4768 wrote to memory of 648	4768	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_64f1d34a5d9953e321a81aa8627c27a8c673ca2a2c9ffacabcb0bdd317502fa2_2022-03-26__034852.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_64f1d34a5d9953e321a81aa8627c27a8c673ca2a2c9ffacabcb0bdd317502fa2_2022-03-26__034852.dll
  2⤵
  PID:648