237ef8d775fb76a62fe9541e608bfb148d44a198822cc5cf827ff150517ba59a

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 11:02

Target

NEAS.084322ea65ac969f839a44e4659c0de0_JC.dll
Size

56KB
MD5

084322ea65ac969f839a44e4659c0de0
SHA1

793f294a4aa46f319f6f903a58115ff29ea2aa95
SHA256

237ef8d775fb76a62fe9541e608bfb148d44a198822cc5cf827ff150517ba59a
SHA512

6c223c6cfdf7612b0848318e004c62487fef1932e8e99167e449441c761005f862922f76bf61e2c40dace00247649187e02f99ae0e5466f98bfcaf300926a556
SSDEEP

768:ZOh7TzTBziifTeiZSVWihwEknh0L7OTLeNfQfpLDPBxyQ8G4Iij+mYhT5B/2YP+M:YZ/nEkh8OTKNmLftRiJYNhr

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2016	2060	rundll32.exe	28
PID 2060 wrote to memory of 2016	2060	rundll32.exe	28
PID 2060 wrote to memory of 2016	2060	rundll32.exe	28
PID 2060 wrote to memory of 2016	2060	rundll32.exe	28
PID 2060 wrote to memory of 2016	2060	rundll32.exe	28
PID 2060 wrote to memory of 2016	2060	rundll32.exe	28
PID 2060 wrote to memory of 2016	2060	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.084322ea65ac969f839a44e4659c0de0_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.084322ea65ac969f839a44e4659c0de0_JC.dll,#1
  2⤵
  PID:2016