eac16ae47a60a4748bc6e3dc6bc15a09120b9e513054d9dd8eb8edd0d9fdb1eb

Analysis

max time kernel
138s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 08:54

Target

NEAS.5616d91c87829789bc37ae3d0da50740_JC.dll
Size

172KB
MD5

5616d91c87829789bc37ae3d0da50740
SHA1

dcbdc6d1ae58aff0217d33828aca76b28f32af1f
SHA256

eac16ae47a60a4748bc6e3dc6bc15a09120b9e513054d9dd8eb8edd0d9fdb1eb
SHA512

d1a2b1f94e820e315c0a5c9a3a2c6de81c5c4621d476e316e545ae270b834a35a1144c7b90e3202d1a12e2ec3f6f010d9484024e97091f08d120f6f04a1e583a
SSDEEP

3072:z7XAA0vXXGNOrw/MpcjtcKZkjXlDA5PtuO6o0BZ2gBM3/7juNyfMFS:HAAiXXHcpcBXRBO6oiZyiNyfgS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1348	2196	rundll32.exe	84
PID 2196 wrote to memory of 1348	2196	rundll32.exe	84
PID 2196 wrote to memory of 1348	2196	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.5616d91c87829789bc37ae3d0da50740_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.5616d91c87829789bc37ae3d0da50740_JC.dll,#1
  2⤵
  PID:1348

memory/1348-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download