1ef2396af91ebcef3acf3d8badba7a4cbe2e2b478b6dcfdd8283db1ad8f2ee71 | Triage

Analysis

max time kernel
86s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 00:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.20b5bb5ae748c6fdeabe9df37568dc30_JC.dll
Size

31KB
MD5

20b5bb5ae748c6fdeabe9df37568dc30
SHA1

70bb0b75f004034b77a886ff894922e3f0835863
SHA256

1ef2396af91ebcef3acf3d8badba7a4cbe2e2b478b6dcfdd8283db1ad8f2ee71
SHA512

07b00a427d650b42b9aa948c3bf60fd10a54b21ac50326f7de81c2cdf2306fd9007da6e03a7c6321a71198db16b8a27db24fe93c4cbce236a584089c7b651307
SSDEEP

768:qrJWA1CqWe0PamHQ267tM/AChqDERIEjN7:kkA1kPamM7tEhkYRIEjx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 4088	3100	rundll32.exe	86
PID 3100 wrote to memory of 4088	3100	rundll32.exe	86
PID 3100 wrote to memory of 4088	3100	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.20b5bb5ae748c6fdeabe9df37568dc30_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.20b5bb5ae748c6fdeabe9df37568dc30_JC.dll,#1
  2⤵
  PID:4088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads