a04ab391c6a4c711f4d8beff093a06539cdcae4d32a382df1b4c952cb37288d5 | Triage

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04-11-2023 09:43

Sharing

Report Analysis Logs

General

Target

NEAS.0b20060085ba3d5cf427a05abdaa0a90_JC.dll
Size

37KB
MD5

0b20060085ba3d5cf427a05abdaa0a90
SHA1

6a420a020986452a1d009dbf7a94572c666ce7a9
SHA256

a04ab391c6a4c711f4d8beff093a06539cdcae4d32a382df1b4c952cb37288d5
SHA512

973132320a226eb8e5df83e6293abbfe19dbfef1e9e3f3a2938d880fe42200789ba30d2a4ccd3ec20ac8db3ed9fc7c6fd5cc811b707281b15ba2c7fa30997103
SSDEEP

768:ItoC8iTBGo571TseLK97sXBj2rB8oZ7u4/:YqiTBG8pAP7ICqo9N/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1464	2608	rundll32.exe	27
PID 2608 wrote to memory of 1464	2608	rundll32.exe	27
PID 2608 wrote to memory of 1464	2608	rundll32.exe	27
PID 2608 wrote to memory of 1464	2608	rundll32.exe	27
PID 2608 wrote to memory of 1464	2608	rundll32.exe	27
PID 2608 wrote to memory of 1464	2608	rundll32.exe	27
PID 2608 wrote to memory of 1464	2608	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0b20060085ba3d5cf427a05abdaa0a90_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0b20060085ba3d5cf427a05abdaa0a90_JC.dll,#1
  2⤵
  PID:1464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads