1ef2396af91ebcef3acf3d8badba7a4cbe2e2b478b6dcfdd8283db1ad8f2ee71 | Triage

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
05/11/2023, 00:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.20b5bb5ae748c6fdeabe9df37568dc30_JC.dll
Size

31KB
MD5

20b5bb5ae748c6fdeabe9df37568dc30
SHA1

70bb0b75f004034b77a886ff894922e3f0835863
SHA256

1ef2396af91ebcef3acf3d8badba7a4cbe2e2b478b6dcfdd8283db1ad8f2ee71
SHA512

07b00a427d650b42b9aa948c3bf60fd10a54b21ac50326f7de81c2cdf2306fd9007da6e03a7c6321a71198db16b8a27db24fe93c4cbce236a584089c7b651307
SSDEEP

768:qrJWA1CqWe0PamHQ267tM/AChqDERIEjN7:kkA1kPamM7tEhkYRIEjx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2176	2464	rundll32.exe	28
PID 2464 wrote to memory of 2176	2464	rundll32.exe	28
PID 2464 wrote to memory of 2176	2464	rundll32.exe	28
PID 2464 wrote to memory of 2176	2464	rundll32.exe	28
PID 2464 wrote to memory of 2176	2464	rundll32.exe	28
PID 2464 wrote to memory of 2176	2464	rundll32.exe	28
PID 2464 wrote to memory of 2176	2464	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.20b5bb5ae748c6fdeabe9df37568dc30_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.20b5bb5ae748c6fdeabe9df37568dc30_JC.dll,#1
  2⤵
  PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads