baaf064f8f3f0f2ca2ee32b5ec93be85c9f2c6f6acf165024b0c94464674ba49

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 08:22

Target

NEAS.f47a90ea1fbb6d5aba412e1c43f4cf20.dll
Size

6KB
MD5

f47a90ea1fbb6d5aba412e1c43f4cf20
SHA1

114b1a61568a69ed76e945527a4f7b6b9209bc4b
SHA256

baaf064f8f3f0f2ca2ee32b5ec93be85c9f2c6f6acf165024b0c94464674ba49
SHA512

2a3a2e1d098b9b21e103043391e64ab3957b2f1d3d4d20787bf6537d4605a7488cfd72e2d9fd656bb7b05c99218079d0a26477669ef626acb5315d84cbfe5ccb
SSDEEP

96:nEY2RrF1eqwi4Rs7vrD6m0ML4+G+244zWr3zBooV6xQmpejWchxrx:EHRh1eppe7vz0M9v244wzH6xQm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 1980	4000	rundll32.exe	63
PID 4000 wrote to memory of 1980	4000	rundll32.exe	63
PID 4000 wrote to memory of 1980	4000	rundll32.exe	63

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.f47a90ea1fbb6d5aba412e1c43f4cf20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.f47a90ea1fbb6d5aba412e1c43f4cf20.dll,#1
  2⤵
  PID:1980