4eaf9580c8b48e93ef3d107417522f1039a21e3af76873a7d0ef41e55d226ba9

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:37

Target

NEAS.c70dac9ebe3568beea9a690b64f63250.dll
Size

728KB
MD5

c70dac9ebe3568beea9a690b64f63250
SHA1

13ce52e102b7935ca40e159ee4772d7d075efc31
SHA256

4eaf9580c8b48e93ef3d107417522f1039a21e3af76873a7d0ef41e55d226ba9
SHA512

e4fca7f225a34045ca0fb21ae8c6a4343089971aa14c9234ebb7e4a192ef5bfe317885486c5541bb5205cbfe2ace0cbbc4759db7df86b70009ec3141883b43df
SSDEEP

12288:smW3zBfq3dXsXXFcidN0DFWQ5SwAmWhND9yJz+b1FcMLmp2ATTSsd:smKztGd+XFcidmDFWQ59AmUNJyJqb1FE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	1388	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1388	1264	rundll32.exe	28
PID 1264 wrote to memory of 1388	1264	rundll32.exe	28
PID 1264 wrote to memory of 1388	1264	rundll32.exe	28
PID 1264 wrote to memory of 1388	1264	rundll32.exe	28
PID 1264 wrote to memory of 1388	1264	rundll32.exe	28
PID 1264 wrote to memory of 1388	1264	rundll32.exe	28
PID 1264 wrote to memory of 1388	1264	rundll32.exe	28
PID 1388 wrote to memory of 2140	1388	rundll32.exe	29
PID 1388 wrote to memory of 2140	1388	rundll32.exe	29
PID 1388 wrote to memory of 2140	1388	rundll32.exe	29
PID 1388 wrote to memory of 2140	1388	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.c70dac9ebe3568beea9a690b64f63250.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.c70dac9ebe3568beea9a690b64f63250.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 196
    3⤵
    - Program crash
    PID:2140