c4419014d5c36d7b6e7096e32590ead01401397bc45e4e038c58ee1a12a7f1fd

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04-11-2023 19:57

Target

NEAS.fe0ab067821e5f00d7b4903cfc782d70_JC.dll
Size

671KB
MD5

fe0ab067821e5f00d7b4903cfc782d70
SHA1

39073198f8e296fb6158b426b78394ee5757e84f
SHA256

c4419014d5c36d7b6e7096e32590ead01401397bc45e4e038c58ee1a12a7f1fd
SHA512

60eb565b6d215f89391506b64a784f9d23b02e5592663b34bb1911d85369b0ab4206b9fd701f7f966ce45c7317bd82cc26fd696a8591939f32d98fdf48c6909c
SSDEEP

12288:HlQXHbjkbigibQM1wh0Azn/NtG86qz01P4UPcOyYzblt59dkEi/P1Txs:FQrjkbigiscATN41PwYdtfib3pW

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2348	1864	rundll32.exe	28
PID 1864 wrote to memory of 2348	1864	rundll32.exe	28
PID 1864 wrote to memory of 2348	1864	rundll32.exe	28
PID 1864 wrote to memory of 2348	1864	rundll32.exe	28
PID 1864 wrote to memory of 2348	1864	rundll32.exe	28
PID 1864 wrote to memory of 2348	1864	rundll32.exe	28
PID 1864 wrote to memory of 2348	1864	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.fe0ab067821e5f00d7b4903cfc782d70_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.fe0ab067821e5f00d7b4903cfc782d70_JC.dll,#1
  2⤵
  PID:2348

memory/2348-0-0x0000000000280000-0x00000000002F3000-memory.dmp

Filesize
460KB

Download
memory/2348-1-0x0000000000280000-0x00000000002F3000-memory.dmp

Filesize
460KB

Download
memory/2348-2-0x0000000000280000-0x00000000002F3000-memory.dmp

Filesize
460KB

Download