1f75c63fe067e501453338329f2d31328ef3986fca57686b60d09d67666654c0 | Triage

Analysis

max time kernel
122s
max time network
142s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 08:21

Sharing

Report Analysis Logs

General

Target

NEAS.e9ec04c465ff8c53fd2078989bec6880.dll
Size

3KB
MD5

e9ec04c465ff8c53fd2078989bec6880
SHA1

b4d551692a6a1c32c4325db662eef362431830fa
SHA256

1f75c63fe067e501453338329f2d31328ef3986fca57686b60d09d67666654c0
SHA512

bd904a4f22fd8dfaf81bf5883fe3533043e3c408a4877f6ebffce14c267e6d0dc176eb748c1ba5499e0a681502a6d129289693e315ec2b538e4d10e594149977

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 880	2244	rundll32.exe	28
PID 2244 wrote to memory of 880	2244	rundll32.exe	28
PID 2244 wrote to memory of 880	2244	rundll32.exe	28
PID 2244 wrote to memory of 880	2244	rundll32.exe	28
PID 2244 wrote to memory of 880	2244	rundll32.exe	28
PID 2244 wrote to memory of 880	2244	rundll32.exe	28
PID 2244 wrote to memory of 880	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.e9ec04c465ff8c53fd2078989bec6880.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.e9ec04c465ff8c53fd2078989bec6880.dll,#1
  2⤵
  PID:880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads