3a3cdaf30ab48873fbd3603b4ea7177cc7f68546bb393ba01c17597b7c8fe2d5

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2023 08:57

Target

NEAS.03c73f6c5ffa81bc8534aacbe9169150_JC.dll
Size

256KB
MD5

03c73f6c5ffa81bc8534aacbe9169150
SHA1

66d58f9762c26f6e3d86684642a0707899794b34
SHA256

3a3cdaf30ab48873fbd3603b4ea7177cc7f68546bb393ba01c17597b7c8fe2d5
SHA512

501725b422a2fec8a04e0544bda6c4648a7b3955e876621854c77a5596cbc6da186e15f9cdea5a1f464521a831a00203a542b6204360eb61895d2601d51f97d7
SSDEEP

3072:E31Tr2D6vV1wLa7S1e/ViZ9lUIrRZgZGNb4ZzDhtB8/lJKqx8mE0Ji5W4r576D44:E12lGEAe9lVrRZgZGN0ZzDeEv5vlODJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4716	2224	regsvr32.exe	86
PID 2224 wrote to memory of 4716	2224	regsvr32.exe	86
PID 2224 wrote to memory of 4716	2224	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.03c73f6c5ffa81bc8534aacbe9169150_JC.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NEAS.03c73f6c5ffa81bc8534aacbe9169150_JC.dll
  2⤵
  PID:4716

memory/4716-0-0x000000004D650000-0x000000004D690000-memory.dmp

Filesize
256KB

Download
memory/4716-1-0x000000004D650000-0x000000004D690000-memory.dmp

Filesize
256KB

Download