f4a1346513c5edf049ad4ab0716a944fb483094e9d2b76f8a64c9f6ab4ed79ef

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 21:14

Target

NEAS.1c13c54eb0820dab55aa1d5b4758df50_JC.dll
Size

64KB
MD5

1c13c54eb0820dab55aa1d5b4758df50
SHA1

2dab84844407ad24bae47728dd4628ac1ccaeddc
SHA256

f4a1346513c5edf049ad4ab0716a944fb483094e9d2b76f8a64c9f6ab4ed79ef
SHA512

e147840a4ac12fd323a63e299f2bf9e818efa0611863fee051ac56d4c6a7ae7a4ba332fbb73de968dda83a2264d3d77417ee959571938d59bde1d52fae48b4c5
SSDEEP

1536:ejk4EXK+SSEhdPnO+iH3YNK4ajT+Aa5QECa7CO:jKcqO+iH3YN8T+AabLP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2800	2612	rundll32.exe	28
PID 2612 wrote to memory of 2800	2612	rundll32.exe	28
PID 2612 wrote to memory of 2800	2612	rundll32.exe	28
PID 2612 wrote to memory of 2800	2612	rundll32.exe	28
PID 2612 wrote to memory of 2800	2612	rundll32.exe	28
PID 2612 wrote to memory of 2800	2612	rundll32.exe	28
PID 2612 wrote to memory of 2800	2612	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.1c13c54eb0820dab55aa1d5b4758df50_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.1c13c54eb0820dab55aa1d5b4758df50_JC.dll,#1
  2⤵
  PID:2800