b12f5f79227e01d47dbb89cdbaf5a33d038e56f0a114ec5f327359fc492486f6

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04-11-2023 10:59

Target

NEAS.1149d1081d156dc1c8a724c4af73e350_JC.dll
Size

6KB
MD5

1149d1081d156dc1c8a724c4af73e350
SHA1

4aa05c811fe61023756b5a029e9f4fb445aa966e
SHA256

b12f5f79227e01d47dbb89cdbaf5a33d038e56f0a114ec5f327359fc492486f6
SHA512

39f4014879d8735f7e7cedf3114ad7656a2b21d5befa1f84f65f14f5844e4590c33d3fd3a538190fbb0567b71c748e5e019adf7cd638af08676d6bc25145703a
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIvNHeTK9fJmxP90Kk+1i7QZFVLVLnP4I1:unSR6bgYuNHeTsAifpeVVnPL1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2104	1968	rundll32.exe	28
PID 1968 wrote to memory of 2104	1968	rundll32.exe	28
PID 1968 wrote to memory of 2104	1968	rundll32.exe	28
PID 1968 wrote to memory of 2104	1968	rundll32.exe	28
PID 1968 wrote to memory of 2104	1968	rundll32.exe	28
PID 1968 wrote to memory of 2104	1968	rundll32.exe	28
PID 1968 wrote to memory of 2104	1968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.1149d1081d156dc1c8a724c4af73e350_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.1149d1081d156dc1c8a724c4af73e350_JC.dll,#1
  2⤵
  PID:2104