73569bdda7a111b9c4b1fb445e1de5a58fab3a9b7cd45c0bc48391dda1d59a0b

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2023 13:29

Target

NEAS.d9c84dae88019f4911e03df9ffed3630_JC.dll
Size

38KB
MD5

d9c84dae88019f4911e03df9ffed3630
SHA1

ba30b42271560ba199d9e38ce86d77d5b44bf1b8
SHA256

73569bdda7a111b9c4b1fb445e1de5a58fab3a9b7cd45c0bc48391dda1d59a0b
SHA512

95707e61e9d8368fd1abce3cc49c0cd22ec994dc583db970521535ca806013f13476b4e1bc735185c6e2bf4a6de82f2afd587fbc4e31979d7e6928a49cbf51dd
SSDEEP

768:AmUwtk5CRdWQ37xGzZF3cu0OUb6g0wzvjn0RNvS:AmUDC3WIxy73cu0OFgZvjnaNvS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3676	3020	rundll32.exe	83
PID 3020 wrote to memory of 3676	3020	rundll32.exe	83
PID 3020 wrote to memory of 3676	3020	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d9c84dae88019f4911e03df9ffed3630_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d9c84dae88019f4911e03df9ffed3630_JC.dll,#1
  2⤵
  PID:3676