199db0a3fef667ec6c9c5321297ce7a37ac46ae1e53994135d5eea68a90ed04a

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
24/10/2023, 02:04

Target

NEAS.48f829a35221d569d5248395bbb8ba70_JC.dll
Size

6KB
MD5

48f829a35221d569d5248395bbb8ba70
SHA1

6316903ed2357fd18ced3d46c851a9553890050f
SHA256

199db0a3fef667ec6c9c5321297ce7a37ac46ae1e53994135d5eea68a90ed04a
SHA512

e7ddf873299eda8112cdf250a0ea6611edbbe367bad349f516e00660761707a57930bd1b789d43d617065aa3819421d209b2edfd69995a3238fbb770fd8e1c88
SSDEEP

48:SsGp63gAST0cMLlD7prUlG9NzgxQXKAmlhFJ2XdskHJzu3iD6+FmSj86dZ/kgPNB:VGEETrMLH5/U

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 2200	1208	rundll32.exe	28
PID 1208 wrote to memory of 2200	1208	rundll32.exe	28
PID 1208 wrote to memory of 2200	1208	rundll32.exe	28
PID 1208 wrote to memory of 2200	1208	rundll32.exe	28
PID 1208 wrote to memory of 2200	1208	rundll32.exe	28
PID 1208 wrote to memory of 2200	1208	rundll32.exe	28
PID 1208 wrote to memory of 2200	1208	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.48f829a35221d569d5248395bbb8ba70_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.48f829a35221d569d5248395bbb8ba70_JC.dll,#1
  2⤵
  PID:2200