f65c5ba5d8f71aa9373f78d1d733a0a37cc7ab6de0b689b1beb259527edd78ac

Analysis

max time kernel
95s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 20:37

Target

NEAS.bb3493a76e6ea14973d3d857c78a1cf0.dll
Size

736KB
MD5

bb3493a76e6ea14973d3d857c78a1cf0
SHA1

d6fc571b03c1fc69331ac09010df11a9101c379b
SHA256

f65c5ba5d8f71aa9373f78d1d733a0a37cc7ab6de0b689b1beb259527edd78ac
SHA512

3abd9fbaf9feff29dd3321e6366163e679efb83bf87266445c80a670ef12ed47eeda60d8b8541f1b5e656630bc8ca456c6e62bac5648c3bf22cd41701548980b
SSDEEP

12288:HlQXHbjkbigibQM1wh0Azn/NtY0uTg9H6aGnZxqYj52qd+DZeo7tEoHT90bF+04d:FQrjkbigiscATNtuTWaZx8qoDZBuz4Y4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 2312	4008	rundll32.exe	86
PID 4008 wrote to memory of 2312	4008	rundll32.exe	86
PID 4008 wrote to memory of 2312	4008	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.bb3493a76e6ea14973d3d857c78a1cf0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.bb3493a76e6ea14973d3d857c78a1cf0.dll,#1
  2⤵
  PID:2312

memory/2312-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download