f4a1346513c5edf049ad4ab0716a944fb483094e9d2b76f8a64c9f6ab4ed79ef

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 21:14

Target

NEAS.1c13c54eb0820dab55aa1d5b4758df50_JC.dll
Size

64KB
MD5

1c13c54eb0820dab55aa1d5b4758df50
SHA1

2dab84844407ad24bae47728dd4628ac1ccaeddc
SHA256

f4a1346513c5edf049ad4ab0716a944fb483094e9d2b76f8a64c9f6ab4ed79ef
SHA512

e147840a4ac12fd323a63e299f2bf9e818efa0611863fee051ac56d4c6a7ae7a4ba332fbb73de968dda83a2264d3d77417ee959571938d59bde1d52fae48b4c5
SSDEEP

1536:ejk4EXK+SSEhdPnO+iH3YNK4ajT+Aa5QECa7CO:jKcqO+iH3YN8T+AabLP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1336	1284	rundll32.exe	80
PID 1284 wrote to memory of 1336	1284	rundll32.exe	80
PID 1284 wrote to memory of 1336	1284	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.1c13c54eb0820dab55aa1d5b4758df50_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.1c13c54eb0820dab55aa1d5b4758df50_JC.dll,#1
  2⤵
  PID:1336