9abe693bf972cfe8bf020b2fee8188260488ff94874151a3355caf3ad2fbff90

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2023 19:42

Target

NEAS.00e55a98c16e8e0a5881fd0b5be21470_JC.dll
Size

5KB
MD5

00e55a98c16e8e0a5881fd0b5be21470
SHA1

47512542ce4434ff1448d63c0dab73228b09f674
SHA256

9abe693bf972cfe8bf020b2fee8188260488ff94874151a3355caf3ad2fbff90
SHA512

860ecdf189e4458979acfb08a14a1498a489a7fc62eecd46b0f533156a836fcdc66512e5b41f20cf24d08238c2ef5d9ae86417c156767dfe34a8efc57adcb071
SSDEEP

48:q0aaPO8jGSLIv+Tqq7NqrhWR07iIsitl6YtDytJFgOrnsB/SsyomXrTj9Hi:1h9jTqMMrY0OI/KYyznSM79C

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 540	3992	rundll32.exe	49
PID 3992 wrote to memory of 540	3992	rundll32.exe	49
PID 3992 wrote to memory of 540	3992	rundll32.exe	49

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.00e55a98c16e8e0a5881fd0b5be21470_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.00e55a98c16e8e0a5881fd0b5be21470_JC.dll,#1
  2⤵
  PID:540