e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6

Analysis

Target
emotet_exe_e4_e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6_2022-04-28__074307.dll
Size 413KB
Sample220428-jktaksbed9
SHA256 e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6
MD5 7062ff5c1677971ebb9731101de7f256
SHA1 6aab2a185940113b2a73b87c1e1718da00f423de
SHA512 bf03065f66b9477ae64b6cbd180aebafe24126fcc6bbb0ff44257d71753a16da5bd13fdca892dcb6c4429c146a68e0e27959df398c35541c31b55c6faf682d03
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1304	1224	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1304	1224	regsvr32.exe	28
PID 1224 wrote to memory of 1304	1224	regsvr32.exe	28
PID 1224 wrote to memory of 1304	1224	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_e05243ec70891d75bbd33d5ac93a6a4f40adcd1d0f9e3e6f8a9cc2331b5c11c6_2022-04-28__074307.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1224 -s 228
  2⤵
  - Program crash
  PID:1304

memory/1224-54-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmp

Download