6769f3dcde3cc9f6fb8fd1fb6a37b52221ef79b97d5d4002c44308da7a24b144

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/12/2024, 13:11

Target

Nursultan Alpha/jaas.dll
Size

27KB
MD5

9698151ea41b729942072646aa2b145e
SHA1

4159e7248b594a59606eece15566b04c3b7cfe3e
SHA256

c96e295149f0880aa8f4abd01ddec38a18c88d47616b3552aa6db777f6b31f4c
SHA512

48b07ef1cc96aa2fafedf8edddf050111df819ae46d1eb80886beb8320230bca4fc294d9c3745b25aea8569c5757180e85e8be7b7b4606f5085395ff5beec14f
SSDEEP

384:E4fwOnuGpnO0+12KKFSk11Q/bxGzmsAIYidvjm8AM+o/8E9VF0NyUVV:HIGpRaK8k11SGCMYi48AMxkEqV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2420	2404	rundll32.exe	28
PID 2404 wrote to memory of 2420	2404	rundll32.exe	28
PID 2404 wrote to memory of 2420	2404	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Nursultan Alpha\jaas.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2404 -s 88
  2⤵
  PID:2420