e04941436a35aa5e422711859b5a22438849efb0b0630c314d3cb04305bd1305

Analysis

max time kernel
127s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2023 05:05

Target

NEAS.5195c7f9da7e79f417817a12a1ebfb80_JC.dll
Size

924KB
MD5

5195c7f9da7e79f417817a12a1ebfb80
SHA1

966a0c0de37a89a02dd74b683832c49cfa8d88ec
SHA256

e04941436a35aa5e422711859b5a22438849efb0b0630c314d3cb04305bd1305
SHA512

39cc1a7e64a1647cd94b1d23263402a4942368e66c50e77ebc97d824650acaf27b8bb20bc7428b7399f11862ebe9bbf7545b0cb12c7dc9423f73dd7398af0d29
SSDEEP

12288:EDmr+iVgwBDyl0eMNjv/OuOvewAXg+v3tDjy02z0rN9hrv5Qdq+:EDmpXDVNL/lOvehgU9h+dq+

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3652	724	WerFault.exe	87
4948	724	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 724	3804	rundll32.exe	87
PID 3804 wrote to memory of 724	3804	rundll32.exe	87
PID 3804 wrote to memory of 724	3804	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.5195c7f9da7e79f417817a12a1ebfb80_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.5195c7f9da7e79f417817a12a1ebfb80_JC.dll,#1
  2⤵
  PID:724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 724 -s 664
    3⤵
    - Program crash
    PID:3652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 724 -s 672
    3⤵
    - Program crash
    PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 724 -ip 724
1⤵
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 724 -ip 724
1⤵
PID:4744