dd3467ae7251a65d784973faa7b6aa21ace9ec8a8a2e8c3b3d02fcd59e3d110c

Analysis

max time kernel
96s
max time network
25s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 09:45

Target

NEAS.060287295e0dff3a474661e3774d6a10_JC.dll
Size

687KB
MD5

060287295e0dff3a474661e3774d6a10
SHA1

5053129fe30a0d62e61d78bb374ffe4c0ba00108
SHA256

dd3467ae7251a65d784973faa7b6aa21ace9ec8a8a2e8c3b3d02fcd59e3d110c
SHA512

79ac7e12ed55533b007f3ba9f258d94b5220d499acf4427053b208698422ad714c06b8fbd7813e26a48e7ac053038966543bfcbc2501fa02ddb5877bc6a6f604
SSDEEP

3072:LyAb2xwKbwa3ffR8aziy+T2zNlUoGtnuQ8M1u2mxIq:LyjWKBfHTHBQlmxj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2540	2672	rundll32.exe	29
PID 2672 wrote to memory of 2540	2672	rundll32.exe	29
PID 2672 wrote to memory of 2540	2672	rundll32.exe	29
PID 2672 wrote to memory of 2540	2672	rundll32.exe	29
PID 2672 wrote to memory of 2540	2672	rundll32.exe	29
PID 2672 wrote to memory of 2540	2672	rundll32.exe	29
PID 2672 wrote to memory of 2540	2672	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.060287295e0dff3a474661e3774d6a10_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.060287295e0dff3a474661e3774d6a10_JC.dll,#1
  2⤵
  PID:2540