42498562b621f4e23c88dd7031a435aeba911a3fc436d2d9ab3bc502abb21df0

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 16:16

Target

NEAS.3bd8752884a82126c7089f8e73b33bc0_JC.dll
Size

3.6MB
MD5

3bd8752884a82126c7089f8e73b33bc0
SHA1

1956f6ed757fbab66216cf266aa70f9a69b7b49b
SHA256

42498562b621f4e23c88dd7031a435aeba911a3fc436d2d9ab3bc502abb21df0
SHA512

02a936e491abed78185587c8e07e34ad701e1bea3fa82b9b2ce565e850e52484d5a2ac21724d574dacc8b23e65d438d6c61d2066b8c53074169a02cba94fe574
SSDEEP

98304:e152l+q6FWcP76CVYUzGhaYoWcaa9v2kZ/II5itSjkD5JJ:w5pRoMWCGsGhxbexdZ/nES05D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2164	2104	rundll32.exe	28
PID 2104 wrote to memory of 2164	2104	rundll32.exe	28
PID 2104 wrote to memory of 2164	2104	rundll32.exe	28
PID 2104 wrote to memory of 2164	2104	rundll32.exe	28
PID 2104 wrote to memory of 2164	2104	rundll32.exe	28
PID 2104 wrote to memory of 2164	2104	rundll32.exe	28
PID 2104 wrote to memory of 2164	2104	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3bd8752884a82126c7089f8e73b33bc0_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3bd8752884a82126c7089f8e73b33bc0_JC.dll,#1
  2⤵
  PID:2164

memory/2164-0-0x0000000000170000-0x0000000000176000-memory.dmp

Filesize
24KB

Download
memory/2164-1-0x0000000010000000-0x00000000103A4000-memory.dmp

Filesize
3.6MB

Download
memory/2164-6-0x0000000000460000-0x0000000000584000-memory.dmp

Filesize
1.1MB

Download
memory/2164-7-0x00000000022F0000-0x00000000023F6000-memory.dmp

Filesize
1.0MB

Download
memory/2164-8-0x00000000022F0000-0x00000000023F6000-memory.dmp

Filesize
1.0MB

Download
memory/2164-10-0x00000000022F0000-0x00000000023F6000-memory.dmp

Filesize
1.0MB

Download
memory/2164-11-0x00000000022F0000-0x00000000023F6000-memory.dmp

Filesize
1.0MB

Download