b84f0029a2a6fcff55f22c582d868786e63de0dc2f6517ff7cfa954424bcaf07

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 14:29

Target

NEAS.48dbde172b3406f63e3eb6967612de80_JC.dll
Size

568KB
MD5

48dbde172b3406f63e3eb6967612de80
SHA1

e54041f3a1fa1a1bc9ab22879ef8eeea25a58e49
SHA256

b84f0029a2a6fcff55f22c582d868786e63de0dc2f6517ff7cfa954424bcaf07
SHA512

fcc88f9a41ed73dfb511298758947d83a148b31fcf29e6fa036a9d1962be1c4357cb645454d2202c9eff0d83c83b45c10532e70f516aeadc1f43c8436962e12e
SSDEEP

12288:N7tp8jeqCYYyuB2VuwVoXWc4+9agvjwFveSlCW0RtPD:3hAu2JVJPgEFvBeR9

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3048	3028	rundll32.exe	28
PID 3028 wrote to memory of 3048	3028	rundll32.exe	28
PID 3028 wrote to memory of 3048	3028	rundll32.exe	28
PID 3028 wrote to memory of 3048	3028	rundll32.exe	28
PID 3028 wrote to memory of 3048	3028	rundll32.exe	28
PID 3028 wrote to memory of 3048	3028	rundll32.exe	28
PID 3028 wrote to memory of 3048	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.48dbde172b3406f63e3eb6967612de80_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.48dbde172b3406f63e3eb6967612de80_JC.dll,#1
  2⤵
  PID:3048