fdc1c296804542ff1a7c5fdbef7091fa44bb0e276543ec736e7ac30cab9f6d1a

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 17:52

Target

NEAS.3bf2e408eafcc7920278fcfd58765b00_JC.dll
Size

524KB
MD5

3bf2e408eafcc7920278fcfd58765b00
SHA1

8504275256e0d4d9e06bf9daa9730d68f03dac30
SHA256

fdc1c296804542ff1a7c5fdbef7091fa44bb0e276543ec736e7ac30cab9f6d1a
SHA512

eb4693c84312bc305013b092a2c896252a9327ff2d881664d2fcaabae4009be6230d4f1494f93c6001aaef0e92c28bc1c0c9b79de4113235c4858c6fa6920ae5
SSDEEP

12288:/HfLPkCDt1EG2XVekhdeTxxe474yilCXqbDwqxkw/2://LPkQ1bqAp4bYX+xuw+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4064	3468	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 3468	3588	rundll32.exe	89
PID 3588 wrote to memory of 3468	3588	rundll32.exe	89
PID 3588 wrote to memory of 3468	3588	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3bf2e408eafcc7920278fcfd58765b00_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3bf2e408eafcc7920278fcfd58765b00_JC.dll,#1
  2⤵
  PID:3468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 560
    3⤵
    - Program crash
    PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3468 -ip 3468
1⤵
PID:4420