17d5d0b504afbed5d1723299d1ff2dfc7459fe968b7f9af7ab3fd306f54da250 | Triage

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 17:55

Sharing

Report Analysis Logs

General

Target

NEAS.539346eb13deb378769477c94b3b6590.dll
Size

5KB
MD5

539346eb13deb378769477c94b3b6590
SHA1

02a33e7fa11bad2924f47d5d5bd4d7d0f19f5d64
SHA256

17d5d0b504afbed5d1723299d1ff2dfc7459fe968b7f9af7ab3fd306f54da250
SHA512

bf5d3464536a5c1a7599817d087bcdae5fa1aec1ad1cf3562918fa4dd5cb2847a4d77fc1789515906352fb469054258f7187c07c95d6c5c264ead27fcf6aa943
SSDEEP

96:hy859x0P8Ma8axcFwyfCcXwcP11rRjL5vJ:F5oLtUixP19

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 1608	3092	rundll32.exe	82
PID 3092 wrote to memory of 1608	3092	rundll32.exe	82
PID 3092 wrote to memory of 1608	3092	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.539346eb13deb378769477c94b3b6590.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.539346eb13deb378769477c94b3b6590.dll,#1
  2⤵
  PID:1608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads