f4689bcbeb1461807126be2a63ef1640ecc2ed2ce415bfe4c5fe52b952c5d506

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 09:06

Target

NEAS.03b3f0bbd33ad1e4801cfb208cf247a0_JC.dll
Size

1004KB
MD5

03b3f0bbd33ad1e4801cfb208cf247a0
SHA1

49e6a8c3c568392c9bd2bf525fc937db93d768f4
SHA256

f4689bcbeb1461807126be2a63ef1640ecc2ed2ce415bfe4c5fe52b952c5d506
SHA512

5bb0534bd5dd9a95ba4896cc9817fc3aa84811139b4aa13b4b254abec682b29a001868ead7ee9fd73c1c06fafb101553df130fdb6dcbb51040b16041c11181ad
SSDEEP

12288:yjbmFHFtNPJBdPoW+/pmBny5GQBKYPmB+t7ghDyxFLgHMOvU20:yjbmFXNfdgX/p6PSKrBxy0HM+70

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1800	852	rundll32.exe	88
PID 852 wrote to memory of 1800	852	rundll32.exe	88
PID 852 wrote to memory of 1800	852	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.03b3f0bbd33ad1e4801cfb208cf247a0_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.03b3f0bbd33ad1e4801cfb208cf247a0_JC.dll,#1
  2⤵
  PID:1800

memory/1800-0-0x0000000010000000-0x00000000100FD000-memory.dmp

Filesize
1012KB

Download