9b8ac56c0ae0b0376eba5203fd946ab9e13cf7159a44dbc18b217eb251a9ada0

Analysis

max time kernel
201s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 14:47

Target

NEAS.20fb07ab922bde66330bf39fa942e730_JC.dll
Size

172KB
MD5

20fb07ab922bde66330bf39fa942e730
SHA1

3ec96a454b457983501e01b02b967be250195412
SHA256

9b8ac56c0ae0b0376eba5203fd946ab9e13cf7159a44dbc18b217eb251a9ada0
SHA512

e66c42a3cc683d06a7e500d8bf16b1c229c1af047c340913583c3d7433c3e4d32c41c216ee7e5858b09cd7e1805990e6e2efd93ec1e0d266b2b81031c2bb49e2
SSDEEP

3072:z7XAA0vXXGNOrw/MpcjtcKZkjXlDA5PtuO6o0BZ2gBM3/7juNyfMFS:HAAiXXHcpcBXRBO6oiZyiNyfgS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4716	4204	rundll32.exe	86
PID 4204 wrote to memory of 4716	4204	rundll32.exe	86
PID 4204 wrote to memory of 4716	4204	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.20fb07ab922bde66330bf39fa942e730_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.20fb07ab922bde66330bf39fa942e730_JC.dll,#1
  2⤵
  PID:4716

memory/4716-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4716-1-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download