0cef40dae836501dd220c2204ab6c2e88eedae0a6fb36a5293a23ccbf2a28dea

Analysis

max time kernel
118s
max time network
145s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 20:28

Target

NEAS.bf025afaf5d0d7681cec8d2f3a873f50_JC.dll
Size

100KB
MD5

bf025afaf5d0d7681cec8d2f3a873f50
SHA1

9091e225977aaa990409dda6acb159a4bfdc73b4
SHA256

0cef40dae836501dd220c2204ab6c2e88eedae0a6fb36a5293a23ccbf2a28dea
SHA512

09ed1df380bd4ef91b6a3435ce2acaa806bae62f51d56ab7960df0ec92b70f1b3b968f87ef28e9ebc953a781653b993ee8f78bbff1c76ba2b6bea47544dca3c5
SSDEEP

1536:GN/gA2RBO9HY0CvCsqwISDp0N44Imneb2KzZUo1mnfmXg/HU:GhpdCVtpsleco1wfmXg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	2680	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2680	2840	rundll32.exe	29
PID 2840 wrote to memory of 2680	2840	rundll32.exe	29
PID 2840 wrote to memory of 2680	2840	rundll32.exe	29
PID 2840 wrote to memory of 2680	2840	rundll32.exe	29
PID 2840 wrote to memory of 2680	2840	rundll32.exe	29
PID 2840 wrote to memory of 2680	2840	rundll32.exe	29
PID 2840 wrote to memory of 2680	2840	rundll32.exe	29
PID 2680 wrote to memory of 2652	2680	rundll32.exe	30
PID 2680 wrote to memory of 2652	2680	rundll32.exe	30
PID 2680 wrote to memory of 2652	2680	rundll32.exe	30
PID 2680 wrote to memory of 2652	2680	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.bf025afaf5d0d7681cec8d2f3a873f50_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.bf025afaf5d0d7681cec8d2f3a873f50_JC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 240
    3⤵
    - Program crash
    PID:2652