c0b7d9f3238c56cdc6f95e86e2c0c1de58bd9cd02df4b7bddd48158c893a0d40

Analysis

max time kernel
151s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 20:33

Target

NEAS.047f2a9b4dbfb89f92eb93b253e722c0_JC.dll
Size

56KB
MD5

047f2a9b4dbfb89f92eb93b253e722c0
SHA1

81fdbd37376c624a977f8a5031d88dcafba4176f
SHA256

c0b7d9f3238c56cdc6f95e86e2c0c1de58bd9cd02df4b7bddd48158c893a0d40
SHA512

c1723e249ce5c083cf4af6c7ceb8a5c8f2ac3f85cf934254961636b486a4358fce7dc1af56f9a0e5e2594020803be487f038dc9bf7f97b14b21a3d5e2c502264
SSDEEP

768:x9tYNOaJuEGoB6Qu3WtzqUM1S7+TPGu9UNzy4s3DcPOwXcViBQzGwEKyTbN5s2Ir:xANOMB6X3W1qP1OfxwmOwXckuSL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 3216	4072	rundll32.exe	86
PID 4072 wrote to memory of 3216	4072	rundll32.exe	86
PID 4072 wrote to memory of 3216	4072	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.047f2a9b4dbfb89f92eb93b253e722c0_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.047f2a9b4dbfb89f92eb93b253e722c0_JC.dll,#1
  2⤵
  PID:3216

memory/3216-0-0x0000000075040000-0x000000007504E000-memory.dmp

Filesize
56KB

Download