49b1decf5a0b250ad65e8ad927eaefc4619b72eb74b86a6fd14a329c6d6aaa15 | Triage

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 20:39

Sharing

Report Analysis Logs

General

Target

NEAS.ca0ace22ad9b2a43356965a31ac04000.dll
Size

6KB
MD5

ca0ace22ad9b2a43356965a31ac04000
SHA1

f3587da56cf0eee2e1ff91228a3f2d35d01d0b34
SHA256

49b1decf5a0b250ad65e8ad927eaefc4619b72eb74b86a6fd14a329c6d6aaa15
SHA512

7d127ea507f04dcf51ceeaa40146bd9b5b07ba8a033c16c68d08f5f6269c617ee9a7bfdcdc7cccc03f7015ec9aac3f5fb02497ae8351404c3ee04b5d70a69396
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0KB+BDq9J5SC:8qtV0HAr4fB+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 680	3684	rundll32.exe	82
PID 3684 wrote to memory of 680	3684	rundll32.exe	82
PID 3684 wrote to memory of 680	3684	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ca0ace22ad9b2a43356965a31ac04000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ca0ace22ad9b2a43356965a31ac04000.dll,#1
  2⤵
  PID:680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads