Analysis
-
max time kernel
141s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2023, 17:31
Behavioral task
behavioral1
Sample
NEAS.ee00b08279338ade666a4a5ba8e3ca90_JC.dll
Resource
win7-20231020-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.ee00b08279338ade666a4a5ba8e3ca90_JC.dll
Resource
win10v2004-20231020-en
5 signatures
150 seconds
General
-
Target
NEAS.ee00b08279338ade666a4a5ba8e3ca90_JC.dll
-
Size
76KB
-
MD5
ee00b08279338ade666a4a5ba8e3ca90
-
SHA1
8e70f4297a0160eeef3b07014b3a4e2be95a4b66
-
SHA256
6523d37ebf0fe5de8ceb3b6007dd626ebd0e0985e50a86b589a8cb3e99a45f6b
-
SHA512
8a3a00c921433e9e22e3c0f35a2140dee1af94d05e793e57573668be30d15e1598a24ddf190419bbada0422e8d0eeffbd9d08bd30a80dde5809cb0c43f22c67c
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZJKC:c8y93KQjy7G55riF1cMo03TD
Score
8/10
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
resource yara_rule behavioral2/memory/3740-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3740-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1236 3740 WerFault.exe 85 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3740 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4352 wrote to memory of 3740 4352 rundll32.exe 85 PID 4352 wrote to memory of 3740 4352 rundll32.exe 85 PID 4352 wrote to memory of 3740 4352 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ee00b08279338ade666a4a5ba8e3ca90_JC.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ee00b08279338ade666a4a5ba8e3ca90_JC.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
PID:3740 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 6963⤵
- Program crash
PID:1236
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3740 -ip 37401⤵PID:5020