ec7cf7ca0c41190d3756da8ba9e7879093e1a8a02b87adfb695bfc2bbad8c777

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2023, 16:57

Target

NEAS.ec7cf7ca0c41190d3756da8ba9e7879093e1a8a02b87adfb695bfc2bbad8c777dll_JC.dll
Size

76KB
MD5

0e4081f0d1799eb480fe71c141e99f86
SHA1

b2e5a2b8200ea7f5b95a7c60f1de908eec53a41c
SHA256

ec7cf7ca0c41190d3756da8ba9e7879093e1a8a02b87adfb695bfc2bbad8c777
SHA512

07106d02165591a3f8815b3302084c4278fafe6d82d546ff8db994bf3be5c096a8ee108eeb83bc413dfcc77541d443fea7eab86a4c5766202babaf6fe0dce5ab
SSDEEP

768:7X0C7nV5TXCetBnjPOJUqKqHAArzh1MkyA5ZAq8V1uPRZIuAaV3:7LLV5jtBbSzhKkbSRV1uPRPAaV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4540	1340	WerFault.exe	61

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 1340	4936	rundll32.exe	61
PID 4936 wrote to memory of 1340	4936	rundll32.exe	61
PID 4936 wrote to memory of 1340	4936	rundll32.exe	61

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ec7cf7ca0c41190d3756da8ba9e7879093e1a8a02b87adfb695bfc2bbad8c777dll_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ec7cf7ca0c41190d3756da8ba9e7879093e1a8a02b87adfb695bfc2bbad8c777dll_JC.dll,#1
  2⤵
  PID:1340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 544
    3⤵
    - Program crash
    PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1340 -ip 1340
1⤵
PID:4656