b5e32d2f73c24b9db437c47118f21dec128dabc71f1a86852583c8844ab04d7e

Analysis

Target
emotet_exe_e5_a595121b517145c8cbe41dce45d7074de54f821348cc70cb6b5649f4cdba0aa9_2022-04-16__011353.dll
Size 664KB
Sample220416-blmv7aechr
SHA256 b5e32d2f73c24b9db437c47118f21dec128dabc71f1a86852583c8844ab04d7e
MD5 5237a46e2a8b452397adf9dadcc6bbac
SHA1 094cdbfcadb272d0e03432c43cf0d46c1e813550
SHA512 3dea85309ddafd36e1bf8bade24f3315df8e78802cd8ff4668e57b504ec380c699a83d515acd5c7c8c4f15ddf8aa0bdb51564d7349a373ab2d4e70b2f85f5ae5
MD5 SHA1 SHA512

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1872	4200	WerFault.exe	77
4932	4200	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 4200	1512	regsvr32.exe	77
PID 1512 wrote to memory of 4200	1512	regsvr32.exe	77
PID 1512 wrote to memory of 4200	1512	regsvr32.exe	77

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a595121b517145c8cbe41dce45d7074de54f821348cc70cb6b5649f4cdba0aa9_2022-04-16__011353.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_a595121b517145c8cbe41dce45d7074de54f821348cc70cb6b5649f4cdba0aa9_2022-04-16__011353.dll
  2⤵
  PID:4200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 680
    3⤵
    - Program crash
    PID:1872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 664
    3⤵
    - Program crash
    PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4200 -ip 4200
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4200 -ip 4200
1⤵
PID:2556