115869cfef33bf7a4528f4766d42c6ded820b19caa3109890584d6f7cb6e2453 | Triage

Analysis

max time kernel
175s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:31

Sharing

Report Analysis Logs

General

Target

NEAS.906389c1d08379e096b98c6508606f40.dll
Size

160KB
MD5

906389c1d08379e096b98c6508606f40
SHA1

e4d82bfeba2bb9c4ec656928300d25589749c7d8
SHA256

115869cfef33bf7a4528f4766d42c6ded820b19caa3109890584d6f7cb6e2453
SHA512

951591927e233d66572d2120bce492c92544f320175f7ff1423c7ca22bb5ef0bb182957ef362b889fdb5b193aaa3d418ff0d513a94126462f503207e1e0e207e
SSDEEP

3072:+0EtNE/8jNU0oR5YeHR2zkpOLoJuT1/MgwXLP:Et6EU7GsBJk/Qb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4820	4312	rundll32.exe	84
PID 4312 wrote to memory of 4820	4312	rundll32.exe	84
PID 4312 wrote to memory of 4820	4312	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.906389c1d08379e096b98c6508606f40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.906389c1d08379e096b98c6508606f40.dll,#1
  2⤵
  PID:4820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4820-0-0x0000000067110000-0x0000000067138000-memory.dmp

Filesize
160KB

Download