4832c597badbb52d122adf04e305a73347dd55d425393c344664dafe06805909

Analysis

max time kernel
139s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2023 18:25

Target

NEAS.77f9ee58c5b54a01ef9b3036e09411f0.dll
Size

139KB
MD5

77f9ee58c5b54a01ef9b3036e09411f0
SHA1

19dfaebe25f803fa9b3f556167d1037ff4c42acc
SHA256

4832c597badbb52d122adf04e305a73347dd55d425393c344664dafe06805909
SHA512

ce8a2a03b86741129809195893b5a1e9760400e537f7a4e2d2a417899736ba84fb6e380e4539d93a0c4cc38d869acd4fac572cdd1ec81fe3e9940cdd25366992
SSDEEP

3072:Msr9E+7NnVmZUKrhgxKbmgQoMxxda5t64pWPE:tl7iixKbmjxdat64pWPE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4884	2460	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 2460	1004	rundll32.exe	81
PID 1004 wrote to memory of 2460	1004	rundll32.exe	81
PID 1004 wrote to memory of 2460	1004	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.77f9ee58c5b54a01ef9b3036e09411f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.77f9ee58c5b54a01ef9b3036e09411f0.dll,#1
  2⤵
  PID:2460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 604
    3⤵
    - Program crash
    PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2460 -ip 2460
1⤵
PID:2620