80033b83a58399b39235747c32d7f00e51c9422392346c9207636d5a6b60e4da

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 17:49

Target

NEAS.29cda04f1884a9272b92018ba7560530.dll
Size

6KB
MD5

29cda04f1884a9272b92018ba7560530
SHA1

0b66506f430979525ab50b2c36f763a71d2897f9
SHA256

80033b83a58399b39235747c32d7f00e51c9422392346c9207636d5a6b60e4da
SHA512

5ceaf4d5fb4b7bb71a14f0732477d9eaf0074da0cf147e0111154a05950f132e72a04b501509acd07b878de031f56d9e64d85431185cdc76732182c43e4f5047
SSDEEP

96:hy859x0P8MaHwDqXup1aJsrWVzsy8QlqsV2/ZujXprA:F5oLjDqXG1aJM6jMx/ZwXpA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1940	1740	rundll32.exe	28
PID 1740 wrote to memory of 1940	1740	rundll32.exe	28
PID 1740 wrote to memory of 1940	1740	rundll32.exe	28
PID 1740 wrote to memory of 1940	1740	rundll32.exe	28
PID 1740 wrote to memory of 1940	1740	rundll32.exe	28
PID 1740 wrote to memory of 1940	1740	rundll32.exe	28
PID 1740 wrote to memory of 1940	1740	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.29cda04f1884a9272b92018ba7560530.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.29cda04f1884a9272b92018ba7560530.dll,#1
  2⤵
  PID:1940