dcfbf3762cc32d0e83965bf702809453031a73fad654c2992cc646d92a936431

Analysis

Target
emotet_exe_e5_dcfbf3762cc32d0e83965bf702809453031a73fad654c2992cc646d92a936431_2022-04-06__013037.dll
Size 575KB
Sample220406-bxc55abddn
SHA256 dcfbf3762cc32d0e83965bf702809453031a73fad654c2992cc646d92a936431
MD5 6d8e5998a1be0aae24864ccacce97b20
SHA1 e9eed7f14ee3d4e2c6e9b855362e4f85f4ab5e22
SHA512 1a63cdd2cd6167fbf1396b8af63f52c0394c4fcb9e89d9e89c1f059d8c01ebd1db44da2891e0168483709cd1e1c68bb3c6d603668ca32142d4dff3031c0cb0df
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 3636	3620	regsvr32.exe	80
PID 3620 wrote to memory of 3636	3620	regsvr32.exe	80
PID 3620 wrote to memory of 3636	3620	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_dcfbf3762cc32d0e83965bf702809453031a73fad654c2992cc646d92a936431_2022-04-06__013037.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_dcfbf3762cc32d0e83965bf702809453031a73fad654c2992cc646d92a936431_2022-04-06__013037.dll
  2⤵
  PID:3636