70dbe4f972bf879ac02a5bd4cac695dd6a3000d860bfb6cf2bc95e380e74eba5 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 20:04

Sharing

Report Analysis Logs

General

Target

NEAS.2eceea031799234ecc46e88abb331c70.dll
Size

6KB
MD5

2eceea031799234ecc46e88abb331c70
SHA1

eba443563283534fa5fed7872e57f3feba440897
SHA256

70dbe4f972bf879ac02a5bd4cac695dd6a3000d860bfb6cf2bc95e380e74eba5
SHA512

d65d330c7ba8db2639299d86d8e41b1fea3a5ac08546450c3bc2d2f6cc13639d52169f6b2ce78fb9441dd2d787991a8e9bae90b07b69442cb9ca2e8c0d32fcb3
SSDEEP

96:hy859x0P8MakXnk1u2UuFqsQjikqqsVjm9G10:F5oL3XCud5WqYX0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2992	2984	rundll32.exe	28
PID 2984 wrote to memory of 2992	2984	rundll32.exe	28
PID 2984 wrote to memory of 2992	2984	rundll32.exe	28
PID 2984 wrote to memory of 2992	2984	rundll32.exe	28
PID 2984 wrote to memory of 2992	2984	rundll32.exe	28
PID 2984 wrote to memory of 2992	2984	rundll32.exe	28
PID 2984 wrote to memory of 2992	2984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2eceea031799234ecc46e88abb331c70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2eceea031799234ecc46e88abb331c70.dll,#1
  2⤵
  PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads