e002998bec006b7bbac021c4b09ec39f2beaf368b592239b223a6a9e824453cf

Analysis

Target
emotet_exe_e5_e002998bec006b7bbac021c4b09ec39f2beaf368b592239b223a6a9e824453cf_2022-04-09__150741.dll
Size 575KB
Sample220409-shv6tsadh9
SHA256 e002998bec006b7bbac021c4b09ec39f2beaf368b592239b223a6a9e824453cf
MD5 b03f63f51527967eb8931c22d1efdc39
SHA1 7452f1523ae7356cf64863df1df814ca189a5fa4
SHA512 7e021c64ee81c0e414ee7de059eb2cc8dc467a8be079ef9a760fd8fb59fa7473a2c5d048d952ae1142ead8e4e5413533f37cb0bfd0420c7966bfe06794746ea6
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 2008	3284	regsvr32.exe	81
PID 3284 wrote to memory of 2008	3284	regsvr32.exe	81
PID 3284 wrote to memory of 2008	3284	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e002998bec006b7bbac021c4b09ec39f2beaf368b592239b223a6a9e824453cf_2022-04-09__150741.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_e002998bec006b7bbac021c4b09ec39f2beaf368b592239b223a6a9e824453cf_2022-04-09__150741.dll
  2⤵
  PID:2008