b5e32d2f73c24b9db437c47118f21dec128dabc71f1a86852583c8844ab04d7e

Analysis

Target
emotet_exe_e5_a595121b517145c8cbe41dce45d7074de54f821348cc70cb6b5649f4cdba0aa9_2022-04-16__011353.dll
Size 664KB
Sample220416-blmv7aechr
SHA256 b5e32d2f73c24b9db437c47118f21dec128dabc71f1a86852583c8844ab04d7e
MD5 5237a46e2a8b452397adf9dadcc6bbac
SHA1 094cdbfcadb272d0e03432c43cf0d46c1e813550
SHA512 3dea85309ddafd36e1bf8bade24f3315df8e78802cd8ff4668e57b504ec380c699a83d515acd5c7c8c4f15ddf8aa0bdb51564d7349a373ab2d4e70b2f85f5ae5
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1232	1912	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1912	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1912	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1912	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1912	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1912	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1912	1092	regsvr32.exe	27
PID 1092 wrote to memory of 1912	1092	regsvr32.exe	27
PID 1912 wrote to memory of 1232	1912	regsvr32.exe	28
PID 1912 wrote to memory of 1232	1912	regsvr32.exe	28
PID 1912 wrote to memory of 1232	1912	regsvr32.exe	28
PID 1912 wrote to memory of 1232	1912	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a595121b517145c8cbe41dce45d7074de54f821348cc70cb6b5649f4cdba0aa9_2022-04-16__011353.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a595121b517145c8cbe41dce45d7074de54f821348cc70cb6b5649f4cdba0aa9_2022-04-16__011353.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 300
    3⤵
    - Program crash
    PID:1232

memory/1092-54-0x000007FEFBF51000-0x000007FEFBF53000-memory.dmp

Download

memory/1912-56-0x0000000075F61000-0x0000000075F63000-memory.dmp

Download