ca74694d5bcb3e1dbc488b483af3f46daae9933b0c6171ee25ecd87bdbe1139d

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 17:50

Target

NEAS.304398fc0bb399ab0b4ef7cb01a9cbd0.dll
Size

1.2MB
MD5

304398fc0bb399ab0b4ef7cb01a9cbd0
SHA1

54d594dad95e786c6f15b0b3d6bae4a9b3420bca
SHA256

ca74694d5bcb3e1dbc488b483af3f46daae9933b0c6171ee25ecd87bdbe1139d
SHA512

8d32531a3741ceaf68824a90af7ebf6c53ad4d05a886369f36798e724625f9341034af4e092914b83225b8f2afa9628ae6823131f1ab1005226f06552f2acf08
SSDEEP

24576:nbbwp9QYuu+Nj2bzGsjnI0eS2gJd1lgHzWVT5ec5jrVsKo03:eE2RnFlgHzoTvrVsK5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2604	2224	rundll32.exe	28
PID 2224 wrote to memory of 2604	2224	rundll32.exe	28
PID 2224 wrote to memory of 2604	2224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.304398fc0bb399ab0b4ef7cb01a9cbd0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2224 -s 84
  2⤵
  PID:2604