361137e1ffc3ddb42f4458acae80b7931e3f2a13f2cf8840f09466ee75e84952

Analysis

max time kernel
139s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 16:02

Target

NEAS.4900ea4b3352a92c74955ab93f864d90_JC.dll
Size

15KB
MD5

4900ea4b3352a92c74955ab93f864d90
SHA1

3f65e02ce340d74172c73860a434bb5cd28eabaa
SHA256

361137e1ffc3ddb42f4458acae80b7931e3f2a13f2cf8840f09466ee75e84952
SHA512

daeadc2eb26f2fbfbeee93d46a5066425894ebfa2ac7e11dabe98b8ff045cded6693e643eb619d0b994b5a385d74b261d16ac6a26713f887ac07ce745899dc8e
SSDEEP

192:eCIyRO2jS4O2FO2eKh2RsO26O2PCuOCGY3O2NYTeZMPq1IL:4y9jDp7EyqZGoNYTeZMPq1IL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3988	4516	rundll32.exe	62
PID 4516 wrote to memory of 3988	4516	rundll32.exe	62
PID 4516 wrote to memory of 3988	4516	rundll32.exe	62

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.4900ea4b3352a92c74955ab93f864d90_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.4900ea4b3352a92c74955ab93f864d90_JC.dll,#1
  2⤵
  PID:3988