6fb461bf85a96646a59d72ccd0bf43f2a7cbae9a9fdc553291deebd7a25f8828

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 13:50

Target

NEAS.0cbfdaabb18847a5f0e5d585163b8290_JC.dll
Size

68KB
MD5

0cbfdaabb18847a5f0e5d585163b8290
SHA1

6797745d85ddef155b6c56bc1e7f484812f44cdc
SHA256

6fb461bf85a96646a59d72ccd0bf43f2a7cbae9a9fdc553291deebd7a25f8828
SHA512

dcebe8757464011e2107ff70a96438c6121270fce135dcacaf2ba9f80617fd16be8c23774789eabcaaf3306c5f40301554cb4a201531b2bf6e079a329b76a1ab
SSDEEP

768:MGw21VzNVITW70ba6Csjqvwloe2wnqP3vjl2kJ8OTUiB9IZ9qWRSYLsqewsO2lCx:McHITWwb8uPoe2l2Z9Gjwelitz3

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 3020	2216	rundll32.exe	28
PID 2216 wrote to memory of 3020	2216	rundll32.exe	28
PID 2216 wrote to memory of 3020	2216	rundll32.exe	28
PID 2216 wrote to memory of 3020	2216	rundll32.exe	28
PID 2216 wrote to memory of 3020	2216	rundll32.exe	28
PID 2216 wrote to memory of 3020	2216	rundll32.exe	28
PID 2216 wrote to memory of 3020	2216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0cbfdaabb18847a5f0e5d585163b8290_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0cbfdaabb18847a5f0e5d585163b8290_JC.dll,#1
  2⤵
  PID:3020