120550fcc0d7eaf24bfdac08615b1bdad4d79ea0fd2bc0dac7048d0beb3b3a7d

Analysis

max time kernel
134s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 17:26

Target

Interop.JPO.dll
Size

103KB
MD5

56956d2d96bcdc82ed6a6781591bc039
SHA1

4bbfc022bd9a891f539779e1a047c640e57e473d
SHA256

0864b2db89af9a38c4307b79f586c75c6c8ab5ea9c3ffa1f28e2be8428c498d7
SHA512

1d53268dbbaf3050995af5e15b5a8f77ac5bbacbbded79f5c9518b8e9ab7ff3871079bea840e4274c7f23c2d596014188ecf27da01c8518821e91e091b4308b1
SSDEEP

1536:LN403VlOLYya6Rsd8ZP2yMGqr9OXpxX4ailPCJDdYMI0eqIeFyR1uEs+fXoO2bMq:f3VZEjP2wqYjOK4MjNI6EFfXoO2bMq

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2128 4376 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2128	4376	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4900 wrote to memory of 4376	4900	rundll32.exe	rundll32.exe
PID 4900 wrote to memory of 4376	4900	rundll32.exe	rundll32.exe
PID 4900 wrote to memory of 4376	4900	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Interop.JPO.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Interop.JPO.dll,#1
  2⤵
  PID:4376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 624
    3⤵
    - Program crash
    PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4376 -ip 4376
1⤵
PID:1368