b1b6236ae69d807197c71f650ee2f1fba337acb3a5117c4431e7772ad6ae23e7 | Triage

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2023 22:47

Sharing

Report Analysis Logs

General

Target

NEAS.04ec9da400c235f4ac0b75e5f51718e0_JC.dll
Size

3KB
MD5

04ec9da400c235f4ac0b75e5f51718e0
SHA1

92fa72be66858662222f89d05227aba1c5d5a2d9
SHA256

b1b6236ae69d807197c71f650ee2f1fba337acb3a5117c4431e7772ad6ae23e7
SHA512

e33ecfa5adfebae5b1022fed8b9f92a8fb764435d46e30a6c7fd99420386bf33ed79246feb40599f0578d0584c51779b7b9c0e600682533988595beedda6a041

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 5004	2064	rundll32.exe	56
PID 2064 wrote to memory of 5004	2064	rundll32.exe	56
PID 2064 wrote to memory of 5004	2064	rundll32.exe	56

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.04ec9da400c235f4ac0b75e5f51718e0_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.04ec9da400c235f4ac0b75e5f51718e0_JC.dll,#1
  2⤵
  PID:5004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads