19998d1e0e464e2d730fb1a990cb4e7822fe35ab0dc41948cae2545a7f58e2a3

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 20:32

Target

NEAS.6d973f00fadcc6dfee6c12263e272f30_JC.dll
Size

76KB
MD5

6d973f00fadcc6dfee6c12263e272f30
SHA1

b4603c41f769cf23408a5be5f8e9fb4e2d92a89c
SHA256

19998d1e0e464e2d730fb1a990cb4e7822fe35ab0dc41948cae2545a7f58e2a3
SHA512

0d1b14ffba4a405d70945d91bab69501adc2fbf23ea6715c27ec715037e72555b3128cae097b0f1bd27594a8ee03c064d24bd2677e10bd044e3afa607cd3553e
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZhORw6H:c8y93KQjy7G55riF1cMo03fORw6H

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3704-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3704-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4528	3704	WerFault.exe	54

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3704	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 180 wrote to memory of 3704	180	rundll32.exe	54
PID 180 wrote to memory of 3704	180	rundll32.exe	54
PID 180 wrote to memory of 3704	180	rundll32.exe	54

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6d973f00fadcc6dfee6c12263e272f30_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6d973f00fadcc6dfee6c12263e272f30_JC.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 712
    3⤵
    - Program crash
    PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3704 -ip 3704
1⤵
PID:1708

memory/3704-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3704-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download