ac1eba2e4a9ca847c6db7ad2338dd84cef38a090a705377b30cb3d121505d22b

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-10-2023 19:52

Target

NEAS.72309e5dc20be7dbc6fb932ebeec7c80_JC.dll
Size

5KB
MD5

72309e5dc20be7dbc6fb932ebeec7c80
SHA1

e4fae4b5db7ecb0bbeda435f03e68b104f681267
SHA256

ac1eba2e4a9ca847c6db7ad2338dd84cef38a090a705377b30cb3d121505d22b
SHA512

e0b1d2b8332033ceeb884548cc7360e799aaa23453a6a68de6c14fd4efbcfc3fa8e81d16593ff5b83e12dfaf37412218296f2b28c54b4fb364caec640c1c2e66
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEq3jaxbssSbZ1ft1Jltt9xv:hy859x0P8Masbs/1LJlttn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 1744	2520	rundll32.exe	27
PID 2520 wrote to memory of 1744	2520	rundll32.exe	27
PID 2520 wrote to memory of 1744	2520	rundll32.exe	27
PID 2520 wrote to memory of 1744	2520	rundll32.exe	27
PID 2520 wrote to memory of 1744	2520	rundll32.exe	27
PID 2520 wrote to memory of 1744	2520	rundll32.exe	27
PID 2520 wrote to memory of 1744	2520	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.72309e5dc20be7dbc6fb932ebeec7c80_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.72309e5dc20be7dbc6fb932ebeec7c80_JC.dll,#1
  2⤵
  PID:1744