f4689bcbeb1461807126be2a63ef1640ecc2ed2ce415bfe4c5fe52b952c5d506

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 09:06

Target

NEAS.03b3f0bbd33ad1e4801cfb208cf247a0_JC.dll
Size

1004KB
MD5

03b3f0bbd33ad1e4801cfb208cf247a0
SHA1

49e6a8c3c568392c9bd2bf525fc937db93d768f4
SHA256

f4689bcbeb1461807126be2a63ef1640ecc2ed2ce415bfe4c5fe52b952c5d506
SHA512

5bb0534bd5dd9a95ba4896cc9817fc3aa84811139b4aa13b4b254abec682b29a001868ead7ee9fd73c1c06fafb101553df130fdb6dcbb51040b16041c11181ad
SSDEEP

12288:yjbmFHFtNPJBdPoW+/pmBny5GQBKYPmB+t7ghDyxFLgHMOvU20:yjbmFXNfdgX/p6PSKrBxy0HM+70

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2440	2888	rundll32.exe	28
PID 2888 wrote to memory of 2440	2888	rundll32.exe	28
PID 2888 wrote to memory of 2440	2888	rundll32.exe	28
PID 2888 wrote to memory of 2440	2888	rundll32.exe	28
PID 2888 wrote to memory of 2440	2888	rundll32.exe	28
PID 2888 wrote to memory of 2440	2888	rundll32.exe	28
PID 2888 wrote to memory of 2440	2888	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.03b3f0bbd33ad1e4801cfb208cf247a0_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.03b3f0bbd33ad1e4801cfb208cf247a0_JC.dll,#1
  2⤵
  PID:2440

memory/2440-0-0x0000000010000000-0x00000000100FD000-memory.dmp

Filesize
1012KB

Download
memory/2440-1-0x0000000010000000-0x00000000100FD000-memory.dmp

Filesize
1012KB

Download