70dbe4f972bf879ac02a5bd4cac695dd6a3000d860bfb6cf2bc95e380e74eba5 | Triage

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:04

Sharing

Report Analysis Logs

General

Target

NEAS.2eceea031799234ecc46e88abb331c70.dll
Size

6KB
MD5

2eceea031799234ecc46e88abb331c70
SHA1

eba443563283534fa5fed7872e57f3feba440897
SHA256

70dbe4f972bf879ac02a5bd4cac695dd6a3000d860bfb6cf2bc95e380e74eba5
SHA512

d65d330c7ba8db2639299d86d8e41b1fea3a5ac08546450c3bc2d2f6cc13639d52169f6b2ce78fb9441dd2d787991a8e9bae90b07b69442cb9ca2e8c0d32fcb3
SSDEEP

96:hy859x0P8MakXnk1u2UuFqsQjikqqsVjm9G10:F5oL3XCud5WqYX0

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 3012	3356	rundll32.exe	52
PID 3356 wrote to memory of 3012	3356	rundll32.exe	52
PID 3356 wrote to memory of 3012	3356	rundll32.exe	52

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2eceea031799234ecc46e88abb331c70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2eceea031799234ecc46e88abb331c70.dll,#1
  2⤵
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads