58d930bfcfe703644d375d73c2edfaf7c65a7eb774f57d4f6b4d3e6e224a9347

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 17:57

Target

NEAS.6a9a4e94f88da8e9026e16a8fac460c0.dll
Size

181KB
MD5

6a9a4e94f88da8e9026e16a8fac460c0
SHA1

dd18ad22de18cebf5ca3a09c324c19a736da9bdc
SHA256

58d930bfcfe703644d375d73c2edfaf7c65a7eb774f57d4f6b4d3e6e224a9347
SHA512

368b32423c742c9efefcec0e5fda88df4239ecf4aeea9e6e0c43b3ef6d0cb7b23f1d2f968857bc3629de3b1a48395028bb327708ada54dbbfd632eeca1526745
SSDEEP

3072:dD57UoSa2fYJHPzCv/JIS5Yk1TejNLpwUSSEuMTHVYNoG:dV1bUWL+I9dafSEuMLS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1956	1064	rundll32.exe	28
PID 1064 wrote to memory of 1956	1064	rundll32.exe	28
PID 1064 wrote to memory of 1956	1064	rundll32.exe	28
PID 1064 wrote to memory of 1956	1064	rundll32.exe	28
PID 1064 wrote to memory of 1956	1064	rundll32.exe	28
PID 1064 wrote to memory of 1956	1064	rundll32.exe	28
PID 1064 wrote to memory of 1956	1064	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6a9a4e94f88da8e9026e16a8fac460c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6a9a4e94f88da8e9026e16a8fac460c0.dll,#1
  2⤵
  PID:1956