5520131e8ea597cf9820116645df7b75f01e9dd05f17d84ed7c4a428b31fa796

Analysis

Target
emotet_exe_e4_5520131e8ea597cf9820116645df7b75f01e9dd05f17d84ed7c4a428b31fa796_2022-04-11__124923.dll
Size 614KB
Sample220411-p2xbfsfbak
SHA256 5520131e8ea597cf9820116645df7b75f01e9dd05f17d84ed7c4a428b31fa796
MD5 53fa825b6cf3f8719d46c2411a5fa5cd
SHA1 f3759509e3c1dc643805d4f45f16fe6341408b91
SHA512 2777eea2ef984d4195972eb1589028f2c73a5c9d0f716c6fc9a18da83625780211ef6ffbd18392d2b7b8f081f7515a50ce30d8eea94949139c93a11380cd546d
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2700	2476	regsvr32.exe	81
PID 2476 wrote to memory of 2700	2476	regsvr32.exe	81
PID 2476 wrote to memory of 2700	2476	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5520131e8ea597cf9820116645df7b75f01e9dd05f17d84ed7c4a428b31fa796_2022-04-11__124923.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_5520131e8ea597cf9820116645df7b75f01e9dd05f17d84ed7c4a428b31fa796_2022-04-11__124923.dll
  2⤵
  PID:2700