619acdbf026e202566c084da2c18a3a4191df472bbb60df957429a7cf661610a

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 19:55

Target

NEAS.acfec14f156eef808b159d1097db6660_JC.dll
Size

6KB
MD5

acfec14f156eef808b159d1097db6660
SHA1

81fd5b3aa4c5a6d315804dc41688928af4867aee
SHA256

619acdbf026e202566c084da2c18a3a4191df472bbb60df957429a7cf661610a
SHA512

b98ec8650b05786b4f92e083300d20164872672e3689b92c059743448375c9d88819f599ef1853f22d46dd4fca0fc4089ce1fc8f43f92504f6a12b0ef12ddea1
SSDEEP

96:hy859x0P8Maxqp/8MSr6VATXBddfln0qAie3KLVMsZX:F5oLAa//fVoFN0b3mVl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 4348	912	rundll32.exe	86
PID 912 wrote to memory of 4348	912	rundll32.exe	86
PID 912 wrote to memory of 4348	912	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.acfec14f156eef808b159d1097db6660_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.acfec14f156eef808b159d1097db6660_JC.dll,#1
  2⤵
  PID:4348