f8ae0a8e7770dd0e3e68cf99b2d9e5d7152a39ca788e2ddfcf93b2118e4649c4

Analysis

max time kernel
183s
max time network
227s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 18:20

Target

Interop.JRO.dll
Size

9KB
MD5

4745258579c81f1ca487ece1e8cfc554
SHA1

60fedb22afd789e748c0fbbcbd927b8f8f848efe
SHA256

8c07d3a5ba27dc0908e0b05e1ed963d16d659faf1e761c4e340b17cd4d0f902b
SHA512

bc9f0c05f6939ae13ed8f4d0a0f9696057b0b986e0c8eaa3807c2878b5530de038e77928135b0e8efa162e48e673f57d48a112b134f1d8c86d97245b5c40d9f8
SSDEEP

96:vGdIIVk0WXq5S55KzS11HBbUw/DNEb7SPF/1E+54SGqBm4FHffxkEsQkExar6RZx:vQWXaS5MSdbX/BzPszSGqBm4KCnZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3780	3068	rundll32.exe	82
PID 3068 wrote to memory of 3780	3068	rundll32.exe	82
PID 3068 wrote to memory of 3780	3068	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Interop.JRO.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Interop.JRO.dll,#1
  2⤵
  PID:3780