e956e34d0edb59f95675265abb7a8709fd642fae1688d2b00b8a65f7c5b6ca13

Analysis

max time kernel
169s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 20:37

Target

PROCESSO_3674.2014.PDF.dll
Size

374KB
MD5

2455e231721131f528cee3adff8fa19a
SHA1

81bf10bef74d942b6f074fdf2b172fd870d4f317
SHA256

4bc07938719a1fac90c4cac2eafe4c5e316a882aec3378396d90ac63f659abd8
SHA512

c449ef6ccb9ac535afcdb0c6f73a14a8244ea946537cf7692f21b4b345aef9443232caecdcadb05a649e71ea82bc36c7d44c441333edfc6eb417f612449f995f
SSDEEP

6144:ROj2SbZCubYZtxdJBSSVjCWxk7/NLsfBwS9JSFczPC7d4JY8UdbZAdPl:xSNCuEZtTJBDWNwfBtjC7d4Y7bZwd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2508	2024	rundll32.exe	82
PID 2024 wrote to memory of 2508	2024	rundll32.exe	82
PID 2024 wrote to memory of 2508	2024	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROCESSO_3674.2014.PDF.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PROCESSO_3674.2014.PDF.dll,#1
  2⤵
  PID:2508