f25a780095730701efac67e9d5b84bc289afea56d96d8aff8a44af69ae606404

Analysis

max time kernel
97s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 15:31

Target
ooiwy.pdf.dll
Size 316KB
Sample221002-sx2l6aebar
SHA256 f25a780095730701efac67e9d5b84bc289afea56d96d8aff8a44af69ae606404
MD5 4e4ae70b6346eae111e31716dc76bc23
SHA1 1e7b9af799048e4112d2468323c5c147e20558f9
SHA512 c6fe39e0d40ef150017d85719d4b4096244e58bd2384e420370302229d816e212658151fcf22bb847f3c16b4da2402a3f8dfc465dba563c5b0572e710018750e
SSDEEP 6144:v39GX5QjsakVCm+3OgNA0VEXf/DQEuOGAG:v65Qu/+egA0VutG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2348	804	rundll32.exe	84
PID 804 wrote to memory of 2348	804	rundll32.exe	84
PID 804 wrote to memory of 2348	804	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ooiwy.pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ooiwy.pdf.dll,#1
  2⤵
  PID:2348