8628383170918e3aa70747b591691d8ceff20471f3d024cab72e19a718049078

Analysis

max time kernel
166s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:32

Target

NEAS.974b3ebf8f0c41249fc67320d1429f30.dll
Size

907KB
MD5

974b3ebf8f0c41249fc67320d1429f30
SHA1

6cba3adb76acb36a0944538f4085b02694ca474a
SHA256

8628383170918e3aa70747b591691d8ceff20471f3d024cab72e19a718049078
SHA512

7e8908fd0e57dd6a22e0611bbb4b3d3e891672e430c1b4f01bf9d7c618267bc056449f4bb6d9dfc1a49c176705d2d3edd6358f3b4df764ecf1d4990b65b0e69b
SSDEEP

12288:cw3k0IwPwtBnQfTeCNcDM17EeuV0TwTHHHLhdQe2YtmI7RLEubdhV4ilhBjvrEHE:40IUwtBnQfTPco1vwTnzAKlF4u/rEH7g

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4048	3392	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3392	1808	rundll32.exe	85
PID 1808 wrote to memory of 3392	1808	rundll32.exe	85
PID 1808 wrote to memory of 3392	1808	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.974b3ebf8f0c41249fc67320d1429f30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.974b3ebf8f0c41249fc67320d1429f30.dll,#1
  2⤵
  PID:3392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 560
    3⤵
    - Program crash
    PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3392 -ip 3392
1⤵
PID:2516