b1f8d422e7dda9d2e4b8328f119dd8ae48090bc8f5a1213c599c886d9027f7d6

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 17:54

Target

NEAS.1d7ed6821f9b44d12fd170cc3dcd55b0_JC.dll
Size

5.0MB
MD5

1d7ed6821f9b44d12fd170cc3dcd55b0
SHA1

20db229433530ed0dd1fc800e098eeb892017fce
SHA256

b1f8d422e7dda9d2e4b8328f119dd8ae48090bc8f5a1213c599c886d9027f7d6
SHA512

cbef8a48121f795ce386068cb32f316595efa8b77c935ef0606341008ed779dd4a41f2aa77db9f1df75befc366628dc7a28f51501439a5e5dc00cbeb7559f1c6
SSDEEP

24576:f0lgOCOICtxqDDibF1gOB3q/ZIU0q8mwhVPTorenSq0Kb67EontUq9vEwXE9cDHt:f0leOxjYtKielNZtTlDZeTd69HEsj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2632	1748	rundll32.exe	29
PID 1748 wrote to memory of 2632	1748	rundll32.exe	29
PID 1748 wrote to memory of 2632	1748	rundll32.exe	29
PID 1748 wrote to memory of 2632	1748	rundll32.exe	29
PID 1748 wrote to memory of 2632	1748	rundll32.exe	29
PID 1748 wrote to memory of 2632	1748	rundll32.exe	29
PID 1748 wrote to memory of 2632	1748	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.1d7ed6821f9b44d12fd170cc3dcd55b0_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.1d7ed6821f9b44d12fd170cc3dcd55b0_JC.dll,#1
  2⤵
  PID:2632