ac1eba2e4a9ca847c6db7ad2338dd84cef38a090a705377b30cb3d121505d22b

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2023 19:52

Target

NEAS.72309e5dc20be7dbc6fb932ebeec7c80_JC.dll
Size

5KB
MD5

72309e5dc20be7dbc6fb932ebeec7c80
SHA1

e4fae4b5db7ecb0bbeda435f03e68b104f681267
SHA256

ac1eba2e4a9ca847c6db7ad2338dd84cef38a090a705377b30cb3d121505d22b
SHA512

e0b1d2b8332033ceeb884548cc7360e799aaa23453a6a68de6c14fd4efbcfc3fa8e81d16593ff5b83e12dfaf37412218296f2b28c54b4fb364caec640c1c2e66
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEq3jaxbssSbZ1ft1Jltt9xv:hy859x0P8Masbs/1LJlttn

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 3460	1536	rundll32.exe	85
PID 1536 wrote to memory of 3460	1536	rundll32.exe	85
PID 1536 wrote to memory of 3460	1536	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.72309e5dc20be7dbc6fb932ebeec7c80_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.72309e5dc20be7dbc6fb932ebeec7c80_JC.dll,#1
  2⤵
  PID:3460