789a5caa394a49af62d404d9bc78f73a2e0aae984c77bff05f29272e35f1dd85

Analysis

max time kernel
149s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 17:48

Target

NEAS.24dedf0ccd9800ca8f9468a985bd7b00.dll
Size

334KB
MD5

24dedf0ccd9800ca8f9468a985bd7b00
SHA1

c227a99efdd48f5b91af99b76a38a9c170ce163f
SHA256

789a5caa394a49af62d404d9bc78f73a2e0aae984c77bff05f29272e35f1dd85
SHA512

f7055a91454a0de8b32250c136bfabdc4fc624782cc3bb43b46f1e17d56e85a0d5b328743297e04fab044495c8bb45774e812c65eb4a2bd3fbcd59a25e5f5513
SSDEEP

6144:eK7SLsGZ9Y7OUDRziN9eojmUe6ZjFq7wi8foUE0A4omZRb/2e67LxABLNC+gVg2:97ksG81e9mUfJqxUE0A43DCh79AxNCb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 208	2608	rundll32.exe	85
PID 2608 wrote to memory of 208	2608	rundll32.exe	85
PID 2608 wrote to memory of 208	2608	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.24dedf0ccd9800ca8f9468a985bd7b00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.24dedf0ccd9800ca8f9468a985bd7b00.dll,#1
  2⤵
  PID:208