80033b83a58399b39235747c32d7f00e51c9422392346c9207636d5a6b60e4da

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 17:49

Target

NEAS.29cda04f1884a9272b92018ba7560530.dll
Size

6KB
MD5

29cda04f1884a9272b92018ba7560530
SHA1

0b66506f430979525ab50b2c36f763a71d2897f9
SHA256

80033b83a58399b39235747c32d7f00e51c9422392346c9207636d5a6b60e4da
SHA512

5ceaf4d5fb4b7bb71a14f0732477d9eaf0074da0cf147e0111154a05950f132e72a04b501509acd07b878de031f56d9e64d85431185cdc76732182c43e4f5047
SSDEEP

96:hy859x0P8MaHwDqXup1aJsrWVzsy8QlqsV2/ZujXprA:F5oLjDqXG1aJM6jMx/ZwXpA

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 880	4992	rundll32.exe	83
PID 4992 wrote to memory of 880	4992	rundll32.exe	83
PID 4992 wrote to memory of 880	4992	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.29cda04f1884a9272b92018ba7560530.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.29cda04f1884a9272b92018ba7560530.dll,#1
  2⤵
  PID:880