17d5d0b504afbed5d1723299d1ff2dfc7459fe968b7f9af7ab3fd306f54da250 | Triage

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 17:55

Sharing

Report Analysis Logs

General

Target

NEAS.539346eb13deb378769477c94b3b6590.dll
Size

5KB
MD5

539346eb13deb378769477c94b3b6590
SHA1

02a33e7fa11bad2924f47d5d5bd4d7d0f19f5d64
SHA256

17d5d0b504afbed5d1723299d1ff2dfc7459fe968b7f9af7ab3fd306f54da250
SHA512

bf5d3464536a5c1a7599817d087bcdae5fa1aec1ad1cf3562918fa4dd5cb2847a4d77fc1789515906352fb469054258f7187c07c95d6c5c264ead27fcf6aa943
SSDEEP

96:hy859x0P8Ma8axcFwyfCcXwcP11rRjL5vJ:F5oLtUixP19

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 3036	2160	rundll32.exe	28
PID 2160 wrote to memory of 3036	2160	rundll32.exe	28
PID 2160 wrote to memory of 3036	2160	rundll32.exe	28
PID 2160 wrote to memory of 3036	2160	rundll32.exe	28
PID 2160 wrote to memory of 3036	2160	rundll32.exe	28
PID 2160 wrote to memory of 3036	2160	rundll32.exe	28
PID 2160 wrote to memory of 3036	2160	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.539346eb13deb378769477c94b3b6590.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.539346eb13deb378769477c94b3b6590.dll,#1
  2⤵
  PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads