ddabd71e65d38dc692c149012bbb8f0111b6f257c4a39005b9edfab919194a0c | Triage

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23-10-2023 17:30

Sharing

Report Analysis Logs

General

Target

NEAS.3df00f2a46baafa8c67c8fb5bdc53e20_JC.dll
Size

6KB
MD5

3df00f2a46baafa8c67c8fb5bdc53e20
SHA1

fecbc9d72d9145cd863a1c013bb4c176adc96f64
SHA256

ddabd71e65d38dc692c149012bbb8f0111b6f257c4a39005b9edfab919194a0c
SHA512

d5ffea0e8b314bbdbf74409b5836c3f167ebd4e8f8b0bd42844516ca66ae862cdf6eccd47143414555bbeeb97a16c19bb2483273728a64d34b63b565e2241f2a
SSDEEP

96:VGEETrMLH5OsbDtInZkmMF2DRrUVwPol:efMpuLMGRrul

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 3004	2664	rundll32.exe	15
PID 2664 wrote to memory of 3004	2664	rundll32.exe	15
PID 2664 wrote to memory of 3004	2664	rundll32.exe	15
PID 2664 wrote to memory of 3004	2664	rundll32.exe	15
PID 2664 wrote to memory of 3004	2664	rundll32.exe	15
PID 2664 wrote to memory of 3004	2664	rundll32.exe	15
PID 2664 wrote to memory of 3004	2664	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3df00f2a46baafa8c67c8fb5bdc53e20_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3df00f2a46baafa8c67c8fb5bdc53e20_JC.dll,#1
  2⤵
  PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads