6ed09d7f42a3cae9efaf5af76063f662bbbe4fbe12381da661ff1d6b952e3155

Analysis

max time kernel
133s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 19:07

Target

NEAS.7ef6c3d941f2d4931bf81f973dd14800_JC.dll
Size

94KB
MD5

7ef6c3d941f2d4931bf81f973dd14800
SHA1

8ac6332e2997ab65fe7001e1bfb6b5338b0ca8d4
SHA256

6ed09d7f42a3cae9efaf5af76063f662bbbe4fbe12381da661ff1d6b952e3155
SHA512

944125a1519da348b9d80527ffc0cfe8a0060d98da2343305616e0f538b59ad86c8d707921b669d6fb35a1d0c953a4c89c9a2e8f7ece93a5eb9ef404c7af1415
SSDEEP

1536:j4Gbj42fbknCARfDAIw+/GOs2M0JpvazuHTBZTqrFJfdadgiIb5:UGbE4bqxRf0IrRs23pSKHTrwFrQub

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1668	1800	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 1800	3172	rundll32.exe	86
PID 3172 wrote to memory of 1800	3172	rundll32.exe	86
PID 3172 wrote to memory of 1800	3172	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.7ef6c3d941f2d4931bf81f973dd14800_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.7ef6c3d941f2d4931bf81f973dd14800_JC.dll,#1
  2⤵
  PID:1800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 612
    3⤵
    - Program crash
    PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1800 -ip 1800
1⤵
PID:2912