d1ff5948ed312fb779ad7d1814615cbc354a97cb29ffdd10fe42f32a2831dbf1

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 11:09

Target

NEAS.8fe73d903ae0d64db81d198f82aa5ee0_JC.dll
Size

99KB
MD5

8fe73d903ae0d64db81d198f82aa5ee0
SHA1

4970d2bff8d8b6846173d1096a8596c63d74ab71
SHA256

d1ff5948ed312fb779ad7d1814615cbc354a97cb29ffdd10fe42f32a2831dbf1
SHA512

e785b06f143d88bfa48eb8b36b35a34fa228d7be573518b22f700d8ee819ca38bb728627aa1379e63a5b5c80a880621f0f545d789251e68abb9d27d90b469c37
SSDEEP

1536:87QWuWbJ/vf6KCrXwQ6Wzj/CiKzRFRfgloIk+udZy6uGY:83uG/fCrX17CLRFRfglo6EU6uGY

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2116	1964	rundll32.exe	28
PID 1964 wrote to memory of 2116	1964	rundll32.exe	28
PID 1964 wrote to memory of 2116	1964	rundll32.exe	28
PID 1964 wrote to memory of 2116	1964	rundll32.exe	28
PID 1964 wrote to memory of 2116	1964	rundll32.exe	28
PID 1964 wrote to memory of 2116	1964	rundll32.exe	28
PID 1964 wrote to memory of 2116	1964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.8fe73d903ae0d64db81d198f82aa5ee0_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.8fe73d903ae0d64db81d198f82aa5ee0_JC.dll,#1
  2⤵
  PID:2116