9b8ac56c0ae0b0376eba5203fd946ab9e13cf7159a44dbc18b217eb251a9ada0

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 14:47 UTC

Target

NEAS.20fb07ab922bde66330bf39fa942e730_JC.dll
Size

172KB
MD5

20fb07ab922bde66330bf39fa942e730
SHA1

3ec96a454b457983501e01b02b967be250195412
SHA256

9b8ac56c0ae0b0376eba5203fd946ab9e13cf7159a44dbc18b217eb251a9ada0
SHA512

e66c42a3cc683d06a7e500d8bf16b1c229c1af047c340913583c3d7433c3e4d32c41c216ee7e5858b09cd7e1805990e6e2efd93ec1e0d266b2b81031c2bb49e2
SSDEEP

3072:z7XAA0vXXGNOrw/MpcjtcKZkjXlDA5PtuO6o0BZ2gBM3/7juNyfMFS:HAAiXXHcpcBXRBO6oiZyiNyfgS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2888	2092	rundll32.exe	28
PID 2092 wrote to memory of 2888	2092	rundll32.exe	28
PID 2092 wrote to memory of 2888	2092	rundll32.exe	28
PID 2092 wrote to memory of 2888	2092	rundll32.exe	28
PID 2092 wrote to memory of 2888	2092	rundll32.exe	28
PID 2092 wrote to memory of 2888	2092	rundll32.exe	28
PID 2092 wrote to memory of 2888	2092	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.20fb07ab922bde66330bf39fa942e730_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.20fb07ab922bde66330bf39fa942e730_JC.dll,#1
  2⤵
  PID:2888

memory/2888-0-0x0000000000250000-0x00000000002C3000-memory.dmp

Filesize
460KB

Download
memory/2888-1-0x0000000000250000-0x00000000002C3000-memory.dmp

Filesize
460KB

Download