120550fcc0d7eaf24bfdac08615b1bdad4d79ea0fd2bc0dac7048d0beb3b3a7d

Analysis

max time kernel
151s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 17:26

Target

Interop.JRO.dll
Size

9KB
MD5

d0f93a924b39033330bbb4773eae8aba
SHA1

ff32d13c54add617aacd5800afbe6227e1b1b6ef
SHA256

3ad1a7015fa2f1320c242f5725f2cf1311bfd5927f2feb95812691136ffbc46d
SHA512

44193cb7200ae9c2ed0dc4d11ac210fb8d8bc908acdcac0a3d3a69c5aed7eb982da5a4527050cff6b5903d959c706b1b963264eb3bb0dbcd50c6c44432ee093c
SSDEEP

96:fGdIIVk0WXq5S55KzS11HBbUw/DNEb7SPF/1E+54SGqBm4FHfnxkEsQkExar6RZx:fQWXaS5MSdbX/BzPszSGqBm4+CnZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4928 wrote to memory of 4148	4928	rundll32.exe	rundll32.exe
PID 4928 wrote to memory of 4148	4928	rundll32.exe	rundll32.exe
PID 4928 wrote to memory of 4148	4928	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Interop.JRO.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4928

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Interop.JRO.dll,#1
2⤵
PID:4148