4cec275436e54e242d407cff086a28427ba36178eb3edd449edc21d1cfbb763e

Analysis

max time kernel
117s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2023, 18:28

Target

NEAS.9422e2cbcdd3aa37eca085849eebc740_JC.dll
Size

172KB
MD5

9422e2cbcdd3aa37eca085849eebc740
SHA1

16f7c4053e3fbbd417dd843520ba976096f64e36
SHA256

4cec275436e54e242d407cff086a28427ba36178eb3edd449edc21d1cfbb763e
SHA512

093dd994acc16fd43414262c1ebf2ad17b524773ef1ba57980c13e908de2c98fdd685eb17d3f6995d0853e4d29993a317eb28b3d1fa8983bd61b6e130e9546f0
SSDEEP

3072:z7XAA0vXXGNOrw/MpcjtcKZkjXlDA5PtuO6o0BZ2gBM3/7juNyfMFS:HAAiXXHcpcBXRBO6oiZyiNyfgS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 2076	3604	rundll32.exe	83
PID 3604 wrote to memory of 2076	3604	rundll32.exe	83
PID 3604 wrote to memory of 2076	3604	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.9422e2cbcdd3aa37eca085849eebc740_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.9422e2cbcdd3aa37eca085849eebc740_JC.dll,#1
  2⤵
  PID:2076

memory/2076-0-0x00000000027E0000-0x0000000002853000-memory.dmp

Filesize
460KB

Download