f1ecb6622206b1578dec359098a23766bca48a7ad14c9c46a08a5cf039712e0f

Analysis

Target
emotet_exe_e4_f1ecb6622206b1578dec359098a23766bca48a7ad14c9c46a08a5cf039712e0f_2022-04-08__023521.dll
Size 682KB
Sample220408-c3kmtscbbl
SHA256 f1ecb6622206b1578dec359098a23766bca48a7ad14c9c46a08a5cf039712e0f
MD5 8a573e7a628bfb8b5d75136020b85e4e
SHA1 63653075eff5ac9fb8aec8cae7b6bfecc0322d4d
SHA512 247ac527c28c7c0130e0b3ca9b3aa80401543e1cb98e7284ae8d454a57b4512c31213ae3a1e0750f76578caee80b83052e05faa773c773dc10620913f12d29dc
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1488	1104	regsvr32.exe	28
PID 1104 wrote to memory of 1488	1104	regsvr32.exe	28
PID 1104 wrote to memory of 1488	1104	regsvr32.exe	28
PID 1104 wrote to memory of 1488	1104	regsvr32.exe	28
PID 1104 wrote to memory of 1488	1104	regsvr32.exe	28
PID 1104 wrote to memory of 1488	1104	regsvr32.exe	28
PID 1104 wrote to memory of 1488	1104	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f1ecb6622206b1578dec359098a23766bca48a7ad14c9c46a08a5cf039712e0f_2022-04-08__023521.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f1ecb6622206b1578dec359098a23766bca48a7ad14c9c46a08a5cf039712e0f_2022-04-08__023521.dll
  2⤵
  PID:1488

memory/1104-54-0x000007FEFBBE1000-0x000007FEFBBE3000-memory.dmp

Download

memory/1488-56-0x00000000764F1000-0x00000000764F3000-memory.dmp

Download