120550fcc0d7eaf24bfdac08615b1bdad4d79ea0fd2bc0dac7048d0beb3b3a7d

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 17:26

Target

Interop.JPO.dll
Size

103KB
MD5

56956d2d96bcdc82ed6a6781591bc039
SHA1

4bbfc022bd9a891f539779e1a047c640e57e473d
SHA256

0864b2db89af9a38c4307b79f586c75c6c8ab5ea9c3ffa1f28e2be8428c498d7
SHA512

1d53268dbbaf3050995af5e15b5a8f77ac5bbacbbded79f5c9518b8e9ab7ff3871079bea840e4274c7f23c2d596014188ecf27da01c8518821e91e091b4308b1
SSDEEP

1536:LN403VlOLYya6Rsd8ZP2yMGqr9OXpxX4ailPCJDdYMI0eqIeFyR1uEs+fXoO2bMq:f3VZEjP2wqYjOK4MjNI6EFfXoO2bMq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1760 wrote to memory of 1836	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1836	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1836	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1836	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1836	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1836	1760	rundll32.exe	rundll32.exe
PID 1760 wrote to memory of 1836	1760	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Interop.JPO.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Interop.JPO.dll,#1
  2⤵
  PID:1836

memory/1836-54-0x0000000000000000-mapping.dmp

Download
memory/1836-55-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download