4cf4091e80156830b47033c1a17b74aad9c50c3aa3c39306f22a118663d81d66

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 21:14

Target

NEAS.56c986eedcaa4d8cc14233746efa1230_JC.dll
Size

596KB
MD5

56c986eedcaa4d8cc14233746efa1230
SHA1

da6cf25a23201e8c5a8729f70ccae7ce9b2ae283
SHA256

4cf4091e80156830b47033c1a17b74aad9c50c3aa3c39306f22a118663d81d66
SHA512

720a24ba7a94d0eabd15d627ef7326467ca3baa08076a1eb8f68f7124006b97c116376ecf1c2309710064ce56b122065764555450e70ab5b99a20832ceb4d04d
SSDEEP

12288:scii0U2S4ZEhkL/6dUZkfUzWd4zNyYLadXHfD+jz2e6kSiE:scii0DS4ZEhzSlRyAaZfc6kS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1796	1192	rundll32.exe	28
PID 1192 wrote to memory of 1796	1192	rundll32.exe	28
PID 1192 wrote to memory of 1796	1192	rundll32.exe	28
PID 1192 wrote to memory of 1796	1192	rundll32.exe	28
PID 1192 wrote to memory of 1796	1192	rundll32.exe	28
PID 1192 wrote to memory of 1796	1192	rundll32.exe	28
PID 1192 wrote to memory of 1796	1192	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.56c986eedcaa4d8cc14233746efa1230_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.56c986eedcaa4d8cc14233746efa1230_JC.dll,#1
  2⤵
  PID:1796

memory/1796-0-0x000000006F540000-0x000000006F761000-memory.dmp

Filesize
2.1MB

Download
memory/1796-1-0x000000006F540000-0x000000006F761000-memory.dmp

Filesize
2.1MB

Download