a885d60e1c2e5f1d05c794d0fe207e40b039f14b67fa3a77a5d3851cb2d8e749

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 16:05

Target

NEAS.055e310cb9e8dfd8627f66ed3ec59240_JC.dll
Size

5KB
MD5

055e310cb9e8dfd8627f66ed3ec59240
SHA1

9eef9db20f9b1b9e075e791b89a204ff643775fb
SHA256

a885d60e1c2e5f1d05c794d0fe207e40b039f14b67fa3a77a5d3851cb2d8e749
SHA512

5167482f7508046a2a718a323dd11b9cd99c1d42c4315441b05d16e7f317ec7e2cd309d475f8105f157f713b04096b1b4e8b9a4df51b5e8eb5bce6e12d9729c7
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqR/Ma1V+CZZDnHuxG0UmZY:hy859x0P8MaGgDnHd0Umq

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 2412	884	rundll32.exe	28
PID 884 wrote to memory of 2412	884	rundll32.exe	28
PID 884 wrote to memory of 2412	884	rundll32.exe	28
PID 884 wrote to memory of 2412	884	rundll32.exe	28
PID 884 wrote to memory of 2412	884	rundll32.exe	28
PID 884 wrote to memory of 2412	884	rundll32.exe	28
PID 884 wrote to memory of 2412	884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.055e310cb9e8dfd8627f66ed3ec59240_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.055e310cb9e8dfd8627f66ed3ec59240_JC.dll,#1
  2⤵
  PID:2412