246e678384c0fa44f67e90eae7d1b7d5780019624e09dd4880f44173e9f09f8d | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 17:32

Sharing

Report Analysis Logs

General

Target

NEAS.17cef582496865705ff463a716634f10_JC.dll
Size

3KB
MD5

17cef582496865705ff463a716634f10
SHA1

7a8344a0eac35637776b675791be0dd08c737fa9
SHA256

246e678384c0fa44f67e90eae7d1b7d5780019624e09dd4880f44173e9f09f8d
SHA512

2e08e96f0852409c3f542bb8e1c8b938d2cf89c38c15f5104519c50d413dad07c09d910a9f0139ac746839674f16ff8d4a73dbc9a4a9aa6933630abab70d806c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2336	2020	rundll32.exe	28
PID 2020 wrote to memory of 2336	2020	rundll32.exe	28
PID 2020 wrote to memory of 2336	2020	rundll32.exe	28
PID 2020 wrote to memory of 2336	2020	rundll32.exe	28
PID 2020 wrote to memory of 2336	2020	rundll32.exe	28
PID 2020 wrote to memory of 2336	2020	rundll32.exe	28
PID 2020 wrote to memory of 2336	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.17cef582496865705ff463a716634f10_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.17cef582496865705ff463a716634f10_JC.dll,#1
  2⤵
  PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads