6ed09d7f42a3cae9efaf5af76063f662bbbe4fbe12381da661ff1d6b952e3155

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 19:07

Target

NEAS.7ef6c3d941f2d4931bf81f973dd14800_JC.dll
Size

94KB
MD5

7ef6c3d941f2d4931bf81f973dd14800
SHA1

8ac6332e2997ab65fe7001e1bfb6b5338b0ca8d4
SHA256

6ed09d7f42a3cae9efaf5af76063f662bbbe4fbe12381da661ff1d6b952e3155
SHA512

944125a1519da348b9d80527ffc0cfe8a0060d98da2343305616e0f538b59ad86c8d707921b669d6fb35a1d0c953a4c89c9a2e8f7ece93a5eb9ef404c7af1415
SSDEEP

1536:j4Gbj42fbknCARfDAIw+/GOs2M0JpvazuHTBZTqrFJfdadgiIb5:UGbE4bqxRf0IrRs23pSKHTrwFrQub

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2924	2928	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2928	1708	rundll32.exe	28
PID 1708 wrote to memory of 2928	1708	rundll32.exe	28
PID 1708 wrote to memory of 2928	1708	rundll32.exe	28
PID 1708 wrote to memory of 2928	1708	rundll32.exe	28
PID 1708 wrote to memory of 2928	1708	rundll32.exe	28
PID 1708 wrote to memory of 2928	1708	rundll32.exe	28
PID 1708 wrote to memory of 2928	1708	rundll32.exe	28
PID 2928 wrote to memory of 2924	2928	rundll32.exe	29
PID 2928 wrote to memory of 2924	2928	rundll32.exe	29
PID 2928 wrote to memory of 2924	2928	rundll32.exe	29
PID 2928 wrote to memory of 2924	2928	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.7ef6c3d941f2d4931bf81f973dd14800_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.7ef6c3d941f2d4931bf81f973dd14800_JC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 228
    3⤵
    - Program crash
    PID:2924