5615f20ecb995140bc2cc8b8c8d942daaaf7aea532791629e42ed8d8a56bcdd9

Analysis

max time kernel
140s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 19:13

Target

NEAS.c8701e1896e030671504b6e917a3bb70.dll
Size

21KB
MD5

c8701e1896e030671504b6e917a3bb70
SHA1

b787ed61896ef5717345ac311bfce63350f4db27
SHA256

5615f20ecb995140bc2cc8b8c8d942daaaf7aea532791629e42ed8d8a56bcdd9
SHA512

7162be6552f12b07aa5bb7973edae4057728f8f0241d677700a033f16b01896e4c338da959cd735bc0a4c980c7a8462236ff5de1d9432863fa8248ed2e4d1d8c
SSDEEP

384:rt0OvGGwt19WaqJcn5vxcL0nh8i5P7tCEandDGgDgf2hdD7:r5Gft1oNmlxNnDp7tCddDGgUf2hl7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 4708	2568	rundll32.exe	81
PID 2568 wrote to memory of 4708	2568	rundll32.exe	81
PID 2568 wrote to memory of 4708	2568	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.c8701e1896e030671504b6e917a3bb70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.c8701e1896e030671504b6e917a3bb70.dll,#1
  2⤵
  PID:4708