ab3066356fc4d9add80886adac1058ce4705f1d8982e5fe7fc43a74b0144beaa

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 12:10

Target

Cliente-Cadastro-093321.pdf.dll
Size

587KB
MD5

fe5aada8b587d975a09e5c0461aab43b
SHA1

c854679d8cf81ffa98cf057d423c556774543c55
SHA256

1a1d7d04bca9b2b14abd36cb37f9caa05ed40a7d812f2d3924bed49c6285ab3f
SHA512

365d4d6b3adebe79d40525ad36f6183be0d89e3638363998a264fbf8f1561d39dff36b16991d6b090d8800db9ce01d2a200792db2e282ae8c2d10d08732367ec
SSDEEP

12288:W47J4lYtpc7US0umWrZ6cs2WhKK/lGRgOUqmq9kR6lhKX0wPv5Ut:/7DKUShhmoK/cRgOnmq9g6xcvWt

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26
PID 1348 wrote to memory of 1236	1348	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cliente-Cadastro-093321.pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cliente-Cadastro-093321.pdf.dll,#1
  2⤵
  PID:1236

memory/1236-55-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1236-56-0x0000000000390000-0x0000000000496000-memory.dmp

Filesize
1.0MB

Download
memory/1236-57-0x0000000000240000-0x00000000002A0000-memory.dmp

Filesize
384KB

Download