70a3699353b36222d570c922d5c8676719116c070e28017fe76194cf42a6323b

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 17:59

Target

NEAS.7562e58e099f8657225ad5538d246120.dll
Size

166KB
MD5

7562e58e099f8657225ad5538d246120
SHA1

53ae23cbc0d815c661ca4aaffc94405b4348bb22
SHA256

70a3699353b36222d570c922d5c8676719116c070e28017fe76194cf42a6323b
SHA512

b5c8e268dfdcb5137a7c17f40c0a71713a20e8641daed67ece82cbe91cdb8e76fcb579d0658bed7ed88bf25ad4a7108ef4b35dcee9f67117b10704b02e7aa933
SSDEEP

3072:5+c7x0DuUKkTaVKYRbSYeu2g9yYCmojiihpzr+IiXBJpTcTcH:5+c7xUKkTUto2pihpzOp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	2420	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2420	2128	rundll32.exe	28
PID 2128 wrote to memory of 2420	2128	rundll32.exe	28
PID 2128 wrote to memory of 2420	2128	rundll32.exe	28
PID 2128 wrote to memory of 2420	2128	rundll32.exe	28
PID 2128 wrote to memory of 2420	2128	rundll32.exe	28
PID 2128 wrote to memory of 2420	2128	rundll32.exe	28
PID 2128 wrote to memory of 2420	2128	rundll32.exe	28
PID 2420 wrote to memory of 1948	2420	rundll32.exe	29
PID 2420 wrote to memory of 1948	2420	rundll32.exe	29
PID 2420 wrote to memory of 1948	2420	rundll32.exe	29
PID 2420 wrote to memory of 1948	2420	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.7562e58e099f8657225ad5538d246120.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.7562e58e099f8657225ad5538d246120.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 236
    3⤵
    - Program crash
    PID:1948

memory/2420-0-0x0000000075490000-0x00000000754BE000-memory.dmp

Filesize
184KB

Download
memory/2420-1-0x0000000075490000-0x00000000754BE000-memory.dmp

Filesize
184KB

Download