7e617cc7c84bff14a82b48b5f2f80a22ef366667222e9822c79a6d8617c7a055

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
05-11-2023 03:47

Target

NEAS.be5efe0933ef8417bd2c17779d1bedb0_JC.dll
Size

28KB
MD5

be5efe0933ef8417bd2c17779d1bedb0
SHA1

8d3145b3e6505da4db6ab3cd2d47c0cf64f809d2
SHA256

7e617cc7c84bff14a82b48b5f2f80a22ef366667222e9822c79a6d8617c7a055
SHA512

fd1d8b1834d6884f78dd39f4e54895809a50e8436fb6ea6808a8a22825779eea78c352800c8a5b5ef147b44a279dd6c219ff180e51109c9e379d06347ab3dca6
SSDEEP

384:Ue63ZheZhVbrddlYsdSMCr1uCLZCy6F+eqhKiQWTAnWT:3wuZzlp+r19F5W+htA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2520	1676	rundll32.exe	28
PID 1676 wrote to memory of 2520	1676	rundll32.exe	28
PID 1676 wrote to memory of 2520	1676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.be5efe0933ef8417bd2c17779d1bedb0_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1676 -s 84
  2⤵
  PID:2520