ac55baf5f0ecc098b8e67d94f7e3960ca5076341a60d9adfce2175938ce0df05

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05/11/2023, 04:23

Target

NEAS.bff1b0470c51a485ce49691194632e10_JC.dll
Size

61KB
MD5

bff1b0470c51a485ce49691194632e10
SHA1

cf7f44d18da3d920a59237b2abd647b9494360ec
SHA256

ac55baf5f0ecc098b8e67d94f7e3960ca5076341a60d9adfce2175938ce0df05
SHA512

6ef987a47be7ab6001512322d8f47b8dd05378fa2f9d87ad45a78d94d82ae34aa7d024c8918eb5af4c27db305638e04b22d7559b6b720d05331e7a26f294d517
SSDEEP

768:QKZ2OeBp3nbqfDIQU0yNbc9MUwmo2eD9Tj6+WgIXXp4Pc9DJ9LyayQK3xD:QKZ2O3FAbnsob9yJZ4U9NxcBD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 3048	2452	rundll32.exe	28
PID 2452 wrote to memory of 3048	2452	rundll32.exe	28
PID 2452 wrote to memory of 3048	2452	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.bff1b0470c51a485ce49691194632e10_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2452 -s 116
  2⤵
  PID:3048