2403b30483550532badd38adb9825352b62749f33b8234e3b2a1e858cddc3422

Analysis

max time kernel
169s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 17:56

Target

NEAS.5e5dbb7fd6d23f29b718938403308620.dll
Size

49KB
MD5

5e5dbb7fd6d23f29b718938403308620
SHA1

baa9b9c650fb027767a4ae8cc1620705ad35ba52
SHA256

2403b30483550532badd38adb9825352b62749f33b8234e3b2a1e858cddc3422
SHA512

1332788d9b54f5a7bc57d5f5cd054bda1af9a70a4da9ebdd13d5d6412429e48c30d756ee419e5062f2c6869c5a9435eb27e4c1ba20fc94dcd7cfc9864ea84ca3
SSDEEP

768:m6h0ZIpTVCvGiuFVo+T7JYvoy+eBMnPGOOetCHAdvkswWbfSBJOyuAjPoNUcVSQy:vTunq3yTBMnPGOO3HAaWjkQjAaVh3i

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\bowazupa.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\podohuti	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2864	rundll32.exe
2864	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 2864	4440	rundll32.exe	83
PID 4440 wrote to memory of 2864	4440	rundll32.exe	83
PID 4440 wrote to memory of 2864	4440	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.5e5dbb7fd6d23f29b718938403308620.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.5e5dbb7fd6d23f29b718938403308620.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:2864

memory/2864-0-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2864-1-0x0000000000E20000-0x0000000000E25000-memory.dmp

Filesize
20KB

Download
memory/2864-2-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2864-3-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download
memory/2864-4-0x0000000010000000-0x000000001001D000-memory.dmp

Filesize
116KB

Download