5df7df870906ea1afb0e9c3e91aa28206db6c95cc8e669c873dbae6e431d49fb

Analysis

max time kernel
266s
max time network
288s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:05

Target

BoletoCobrancaID100720140.PDF.dll
Size

138KB
MD5

ee245cf290507dac0b0b4963e56eba99
SHA1

db958b9992870e6127e5d9f6444a1e3fa58ea4bc
SHA256

a73c7f9e879287357dc19b3c330aef097037835a911c7a9af9e8ed86d5264dab
SHA512

8b4103865b35fc85e365b01fdefd2b3b84b5b5eabb3de397acab1b0c27b68b5962cd22c053838196d3b02715721ae460ded29888d9eeb541da2a59bdc2e41858
SSDEEP

3072:rII7y4yIN7qWtbLrETAj5k/f1y+z8US4CLvHUyYodwi5eqr+RI:cn3WZpy7C/fdwis

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5016 wrote to memory of 4588	5016	rundll32.exe	rundll32.exe
PID 5016 wrote to memory of 4588	5016	rundll32.exe	rundll32.exe
PID 5016 wrote to memory of 4588	5016	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BoletoCobrancaID100720140.PDF.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BoletoCobrancaID100720140.PDF.dll,#1
  2⤵
  PID:4588