9abe693bf972cfe8bf020b2fee8188260488ff94874151a3355caf3ad2fbff90

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03-11-2023 19:42

Target

NEAS.00e55a98c16e8e0a5881fd0b5be21470_JC.dll
Size

5KB
MD5

00e55a98c16e8e0a5881fd0b5be21470
SHA1

47512542ce4434ff1448d63c0dab73228b09f674
SHA256

9abe693bf972cfe8bf020b2fee8188260488ff94874151a3355caf3ad2fbff90
SHA512

860ecdf189e4458979acfb08a14a1498a489a7fc62eecd46b0f533156a836fcdc66512e5b41f20cf24d08238c2ef5d9ae86417c156767dfe34a8efc57adcb071
SSDEEP

48:q0aaPO8jGSLIv+Tqq7NqrhWR07iIsitl6YtDytJFgOrnsB/SsyomXrTj9Hi:1h9jTqMMrY0OI/KYyznSM79C

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3052	2064	rundll32.exe	27
PID 2064 wrote to memory of 3052	2064	rundll32.exe	27
PID 2064 wrote to memory of 3052	2064	rundll32.exe	27
PID 2064 wrote to memory of 3052	2064	rundll32.exe	27
PID 2064 wrote to memory of 3052	2064	rundll32.exe	27
PID 2064 wrote to memory of 3052	2064	rundll32.exe	27
PID 2064 wrote to memory of 3052	2064	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.00e55a98c16e8e0a5881fd0b5be21470_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.00e55a98c16e8e0a5881fd0b5be21470_JC.dll,#1
  2⤵
  PID:3052