5f273330a8b24e91f67a9956be8f6830e93a11f3513ff55140916de1eda92255

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 17:25

Target

NEAS.0a65c13b6e6b691663c8971c2edb87d0_JC.dll
Size

388KB
MD5

0a65c13b6e6b691663c8971c2edb87d0
SHA1

6f43c7022b6fed9de681e31993c9e00f502f6c37
SHA256

5f273330a8b24e91f67a9956be8f6830e93a11f3513ff55140916de1eda92255
SHA512

2a15a267aad52c6047a8364011a7ac47faecb48a7fb37a72d9b3bd1b84f67ec99b205bb5d0e19204f1aa467af18cbcccca9101bdc82a698c7739ac0ccff13bdf
SSDEEP

12288:C/0OLjo7g3IQh8hUWWqD5Yu7xJ34h+ShbEjw3ao3lkNuzZ5A:bwjo7g3IQinpFuBEsrlkMz3A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3084	2372	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 2372	3708	rundll32.exe	82
PID 3708 wrote to memory of 2372	3708	rundll32.exe	82
PID 3708 wrote to memory of 2372	3708	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0a65c13b6e6b691663c8971c2edb87d0_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0a65c13b6e6b691663c8971c2edb87d0_JC.dll,#1
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 612
    3⤵
    - Program crash
    PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2372 -ip 2372
1⤵
PID:3676

memory/2372-0-0x0000000056280000-0x00000000562E8000-memory.dmp

Filesize
416KB

Download
memory/2372-1-0x0000000056280000-0x00000000562E8000-memory.dmp

Filesize
416KB

Download