235aa6c785a78da299d944287d7ac46cf4e9134087173db4d0c7a8b30764c008

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 20:14

Target

NEAS.4663b9b289eb70c47fa801ea4c9a5c00.dll
Size

7KB
MD5

4663b9b289eb70c47fa801ea4c9a5c00
SHA1

3f44ebba0280af34d4903e0152bdbf1da699c334
SHA256

235aa6c785a78da299d944287d7ac46cf4e9134087173db4d0c7a8b30764c008
SHA512

416dbcfa3eb51fb88461ce2aa607a56c8fb0a3fd0c1fdb77f781a2cecb8ba4b573d5158a3c353a50fb874e62d821634236d8fb874f0365aa03f267fc6ed67381
SSDEEP

96:hyZxm/jmjhjvj3jcZGV425OMHGJtcVjnrkpkj6PiTusHE8PtBWwmeeSP:2M/SdjbgYsmOgPkyjqOEdS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2916	2928	rundll32.exe	28
PID 2928 wrote to memory of 2916	2928	rundll32.exe	28
PID 2928 wrote to memory of 2916	2928	rundll32.exe	28
PID 2928 wrote to memory of 2916	2928	rundll32.exe	28
PID 2928 wrote to memory of 2916	2928	rundll32.exe	28
PID 2928 wrote to memory of 2916	2928	rundll32.exe	28
PID 2928 wrote to memory of 2916	2928	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.4663b9b289eb70c47fa801ea4c9a5c00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.4663b9b289eb70c47fa801ea4c9a5c00.dll,#1
  2⤵
  PID:2916