9943fd9605444d61724295c44fba3a2d8447f1734f0d092c6075559b10fb3a31

Analysis

max time kernel
156s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:37

Target

NEAS.bcc5f343b38fb0827cc94bbf54845950.dll
Size

6KB
MD5

bcc5f343b38fb0827cc94bbf54845950
SHA1

6114388b1ece89e100626c7c0bd09e420e803625
SHA256

9943fd9605444d61724295c44fba3a2d8447f1734f0d092c6075559b10fb3a31
SHA512

65725af09daab57de6103f78839c3932c72e203397a50b1d93db029b2b0695256ceadfe1a95ea2bf79d072bb8f8615eca59128477238f46b593864ff3245fd85
SSDEEP

48:C6VonAHso6U7lYa92RrpjwDmetlG95hx+iMHhmZHWhNHCMBdhRZBImAAmclUF/nd:nEY2RrF1eqwi4z4mAAfT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 1596	3768	rundll32.exe	85
PID 3768 wrote to memory of 1596	3768	rundll32.exe	85
PID 3768 wrote to memory of 1596	3768	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.bcc5f343b38fb0827cc94bbf54845950.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.bcc5f343b38fb0827cc94bbf54845950.dll,#1
  2⤵
  PID:1596