b1b6236ae69d807197c71f650ee2f1fba337acb3a5117c4431e7772ad6ae23e7 | Triage

Analysis

max time kernel
117s
max time network
134s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04-11-2023 22:47

Sharing

Report Analysis Logs

General

Target

NEAS.04ec9da400c235f4ac0b75e5f51718e0_JC.dll
Size

3KB
MD5

04ec9da400c235f4ac0b75e5f51718e0
SHA1

92fa72be66858662222f89d05227aba1c5d5a2d9
SHA256

b1b6236ae69d807197c71f650ee2f1fba337acb3a5117c4431e7772ad6ae23e7
SHA512

e33ecfa5adfebae5b1022fed8b9f92a8fb764435d46e30a6c7fd99420386bf33ed79246feb40599f0578d0584c51779b7b9c0e600682533988595beedda6a041

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2420	1928	rundll32.exe	27
PID 1928 wrote to memory of 2420	1928	rundll32.exe	27
PID 1928 wrote to memory of 2420	1928	rundll32.exe	27
PID 1928 wrote to memory of 2420	1928	rundll32.exe	27
PID 1928 wrote to memory of 2420	1928	rundll32.exe	27
PID 1928 wrote to memory of 2420	1928	rundll32.exe	27
PID 1928 wrote to memory of 2420	1928	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.04ec9da400c235f4ac0b75e5f51718e0_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.04ec9da400c235f4ac0b75e5f51718e0_JC.dll,#1
  2⤵
  PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads