a04ab391c6a4c711f4d8beff093a06539cdcae4d32a382df1b4c952cb37288d5 | Triage

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 09:43

Sharing

Report Analysis Logs

General

Target

NEAS.0b20060085ba3d5cf427a05abdaa0a90_JC.dll
Size

37KB
MD5

0b20060085ba3d5cf427a05abdaa0a90
SHA1

6a420a020986452a1d009dbf7a94572c666ce7a9
SHA256

a04ab391c6a4c711f4d8beff093a06539cdcae4d32a382df1b4c952cb37288d5
SHA512

973132320a226eb8e5df83e6293abbfe19dbfef1e9e3f3a2938d880fe42200789ba30d2a4ccd3ec20ac8db3ed9fc7c6fd5cc811b707281b15ba2c7fa30997103
SSDEEP

768:ItoC8iTBGo571TseLK97sXBj2rB8oZ7u4/:YqiTBG8pAP7ICqo9N/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 4896	2280	rundll32.exe	86
PID 2280 wrote to memory of 4896	2280	rundll32.exe	86
PID 2280 wrote to memory of 4896	2280	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0b20060085ba3d5cf427a05abdaa0a90_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0b20060085ba3d5cf427a05abdaa0a90_JC.dll,#1
  2⤵
  PID:4896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads