03d8ad7e88491fe8067acf2165adb670188687edc3c8885e27c4af55d7257f64

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 16:08

Target

NEAS.5eee76731548a12ba6c90acfbf863e70_JC.dll
Size

7KB
MD5

5eee76731548a12ba6c90acfbf863e70
SHA1

229ae444a9931ef6063bbd7f0f372e933fd610aa
SHA256

03d8ad7e88491fe8067acf2165adb670188687edc3c8885e27c4af55d7257f64
SHA512

6585858a97640b3016927eaec1fc07687072e1dd30d966703b00f8ad65521ddacab34eb187365c0ec60843154c0a98e07f167d346c5e29bc5902f5fae43107d4
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIw+ltrF53/WC/JFidwTS4YJkayL8TISfRgUMcjgC:unSR6bgY1+ltrF5R4sYTxMcE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 4976	2016	rundll32.exe	90
PID 2016 wrote to memory of 4976	2016	rundll32.exe	90
PID 2016 wrote to memory of 4976	2016	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.5eee76731548a12ba6c90acfbf863e70_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.5eee76731548a12ba6c90acfbf863e70_JC.dll,#1
  2⤵
  PID:4976