0cef40dae836501dd220c2204ab6c2e88eedae0a6fb36a5293a23ccbf2a28dea

Analysis

max time kernel
80s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 20:28

Target

NEAS.bf025afaf5d0d7681cec8d2f3a873f50_JC.dll
Size

100KB
MD5

bf025afaf5d0d7681cec8d2f3a873f50
SHA1

9091e225977aaa990409dda6acb159a4bfdc73b4
SHA256

0cef40dae836501dd220c2204ab6c2e88eedae0a6fb36a5293a23ccbf2a28dea
SHA512

09ed1df380bd4ef91b6a3435ce2acaa806bae62f51d56ab7960df0ec92b70f1b3b968f87ef28e9ebc953a781653b993ee8f78bbff1c76ba2b6bea47544dca3c5
SSDEEP

1536:GN/gA2RBO9HY0CvCsqwISDp0N44Imneb2KzZUo1mnfmXg/HU:GhpdCVtpsleco1wfmXg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3920	224	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 224	4480	rundll32.exe	84
PID 4480 wrote to memory of 224	4480	rundll32.exe	84
PID 4480 wrote to memory of 224	4480	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.bf025afaf5d0d7681cec8d2f3a873f50_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.bf025afaf5d0d7681cec8d2f3a873f50_JC.dll,#1
  2⤵
  PID:224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 620
    3⤵
    - Program crash
    PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 224 -ip 224
1⤵
PID:3024