c4419014d5c36d7b6e7096e32590ead01401397bc45e4e038c58ee1a12a7f1fd

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2023 19:57

Target

NEAS.fe0ab067821e5f00d7b4903cfc782d70_JC.dll
Size

671KB
MD5

fe0ab067821e5f00d7b4903cfc782d70
SHA1

39073198f8e296fb6158b426b78394ee5757e84f
SHA256

c4419014d5c36d7b6e7096e32590ead01401397bc45e4e038c58ee1a12a7f1fd
SHA512

60eb565b6d215f89391506b64a784f9d23b02e5592663b34bb1911d85369b0ab4206b9fd701f7f966ce45c7317bd82cc26fd696a8591939f32d98fdf48c6909c
SSDEEP

12288:HlQXHbjkbigibQM1wh0Azn/NtG86qz01P4UPcOyYzblt59dkEi/P1Txs:FQrjkbigiscATN41PwYdtfib3pW

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1660	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 1432	3188	rundll32.exe	86
PID 3188 wrote to memory of 1432	3188	rundll32.exe	86
PID 3188 wrote to memory of 1432	3188	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.fe0ab067821e5f00d7b4903cfc782d70_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.fe0ab067821e5f00d7b4903cfc782d70_JC.dll,#1
  2⤵
  PID:1432

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1660

memory/1432-0-0x0000000000650000-0x00000000006C3000-memory.dmp

Filesize
460KB

Download
memory/1660-1-0x0000028C9C340000-0x0000028C9C350000-memory.dmp

Filesize
64KB

Download
memory/1660-17-0x0000028C9C440000-0x0000028C9C450000-memory.dmp

Filesize
64KB

Download
memory/1660-33-0x0000028CA47A0000-0x0000028CA47A1000-memory.dmp

Filesize
4KB

Download
memory/1660-35-0x0000028CA47D0000-0x0000028CA47D1000-memory.dmp

Filesize
4KB

Download
memory/1660-36-0x0000028CA47D0000-0x0000028CA47D1000-memory.dmp

Filesize
4KB

Download
memory/1660-37-0x0000028CA48E0000-0x0000028CA48E1000-memory.dmp

Filesize
4KB

Download