Analysis
-
max time kernel
143s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:07
Behavioral task
behavioral1
Sample
62b82255d14250c31bea18c23a0d468ced0f552ad488e9f869a2eb4ff00afce4_JC.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
62b82255d14250c31bea18c23a0d468ced0f552ad488e9f869a2eb4ff00afce4_JC.dll
Resource
win10v2004-20230915-en
General
-
Target
62b82255d14250c31bea18c23a0d468ced0f552ad488e9f869a2eb4ff00afce4_JC.dll
-
Size
44KB
-
MD5
f2fce2e4bcb49ba32df2a5d4bb8c6644
-
SHA1
c53eba835d111b487b3550ebeac4e556b7c58e75
-
SHA256
62b82255d14250c31bea18c23a0d468ced0f552ad488e9f869a2eb4ff00afce4
-
SHA512
4fe204c3370c23571105c69338c497bd3b84c5db9caf8e27530fc809c124cbe1b8eac15bec95494414e89e4f7e1a8733e1df5024fbf81e6627e3ca86e84e0723
-
SSDEEP
768:SX/rx/qCa8OmwxfhqwSJ9z7XdjP0lBdCEtDsh4eLiTL7gpP1ZXOTy:Svrx/qp8OmwxfhyVxQlBdvW4eLOL7eX7
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3288 wrote to memory of 1128 3288 rundll32.exe rundll32.exe PID 3288 wrote to memory of 1128 3288 rundll32.exe rundll32.exe PID 3288 wrote to memory of 1128 3288 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\62b82255d14250c31bea18c23a0d468ced0f552ad488e9f869a2eb4ff00afce4_JC.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\62b82255d14250c31bea18c23a0d468ced0f552ad488e9f869a2eb4ff00afce4_JC.dll,#12⤵