441df34ab7158856bceb5cda08e1a5cbc964e704197d93a4fa574c30c0a1f797 | Triage

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.f434f9b7b6558190b012ed4f512bda00_JC.dll
Size

3KB
MD5

f434f9b7b6558190b012ed4f512bda00
SHA1

23bfd60a18b6aac35d205de86b7bc67951cf8296
SHA256

441df34ab7158856bceb5cda08e1a5cbc964e704197d93a4fa574c30c0a1f797
SHA512

52289e02b2764c3f5f3252337c76762f67a76eb78d0740ddce17e3fc881e17e6d0de8b3f916e45d4d5c3e9bee45296977e247e9d9ba0964327e6b0090aedd7f4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2676	4800	rundll32.exe	73
PID 4800 wrote to memory of 2676	4800	rundll32.exe	73
PID 4800 wrote to memory of 2676	4800	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.f434f9b7b6558190b012ed4f512bda00_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.f434f9b7b6558190b012ed4f512bda00_JC.dll,#1
  2⤵
  PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads