b3aadd119287ed0888fb1c3bc73fdf1db24f7c45466fd8b5172932af76ce2ef5

Analysis

Target
emotet_exe_e4_b3aadd119287ed0888fb1c3bc73fdf1db24f7c45466fd8b5172932af76ce2ef5_2022-04-05__152122.dll
Size 702KB
Sample220405-srwtqahce6
SHA256 b3aadd119287ed0888fb1c3bc73fdf1db24f7c45466fd8b5172932af76ce2ef5
MD5 908b2da6befc75f8de2cc2f3cbad5496
SHA1 e849fcb58cceb62f707b490dca2b9f2ba72cfae3
SHA512 1dc727eaefe4a88ebe470ecc41959801a9411e55ad70555784eb7a93bb98f6fa35da9964ae43ddb38d10d2b8e9d66839930d89563b4bc776d5ef65c0c8eecd3a
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3968	3372	regsvr32.exe	80
PID 3372 wrote to memory of 3968	3372	regsvr32.exe	80
PID 3372 wrote to memory of 3968	3372	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_b3aadd119287ed0888fb1c3bc73fdf1db24f7c45466fd8b5172932af76ce2ef5_2022-04-05__152122.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_b3aadd119287ed0888fb1c3bc73fdf1db24f7c45466fd8b5172932af76ce2ef5_2022-04-05__152122.dll
  2⤵
  PID:3968