7b159f8b01838bda4e8aff3e6c1ed3fdd68d0e418b54a3101545f60f26bc4aed

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:33

Target
NEAS.a16214806332751377f64a17d1e51e70.dll
Size 182KB
Sample231013-zbzc8sdb2v
SHA256 7b159f8b01838bda4e8aff3e6c1ed3fdd68d0e418b54a3101545f60f26bc4aed
MD5 a16214806332751377f64a17d1e51e70
SHA1 9ffc024f9cc040acb52a8b2131fdc97fd3a81b13
SHA512 e82e1ab6e6e4b86371c586c4879ba8847f2caaa4318c3ec08e94f68150452efe6060f47b5d3996ddc8250c524dd344063d00a056a896085269511e49841eccb7
SSDEEP 3072:A81M+tYU06cwxxKEYLRjM/HRBwfY7bi0tSKFNNOKud5JaB2lQBV+UdE+rECWp7hE:A8RtYU0bwxxKEYLRjy2Y7bi0YKzNOKuw
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2800	4916	rundll32.exe	82
PID 4916 wrote to memory of 2800	4916	rundll32.exe	82
PID 4916 wrote to memory of 2800	4916	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.a16214806332751377f64a17d1e51e70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.a16214806332751377f64a17d1e51e70.dll,#1
  2⤵
  PID:2800