f8ae0a8e7770dd0e3e68cf99b2d9e5d7152a39ca788e2ddfcf93b2118e4649c4

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 18:20

Target

Interop.JPO.dll
Size

103KB
MD5

e5e78292a4c0b97c74c74722da1826b0
SHA1

61f8b3e83f09f31f0dc9eed2453f4db266190b24
SHA256

039e9853cf3cf78551cb7b59ff647add0bae21aa027e4cb22974705e10e909dc
SHA512

0a5b8a64e676c3999338ec85c3edc883bf8d1ff7562b2e088f390096a19aead867917d9bb41e73101f19c55066123af15816225a1c82762cc9edbd2f9685ab67
SSDEEP

1536:LhC/3VlOMMHI8b8lljyMM1r1SpWOsdkwmB+qUJDWaKie1zqVs0/Nb8o1LPayc:S3VUwlljq1x3PdJxfjKi4zk7917ayc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1688 wrote to memory of 2000	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2000	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2000	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2000	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2000	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2000	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 2000	1688	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Interop.JPO.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Interop.JPO.dll,#1
  2⤵
  PID:2000

memory/2000-54-0x0000000000000000-mapping.dmp

Download
memory/2000-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download