4eaf9580c8b48e93ef3d107417522f1039a21e3af76873a7d0ef41e55d226ba9

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 18:37

Target

NEAS.c70dac9ebe3568beea9a690b64f63250.dll
Size

728KB
MD5

c70dac9ebe3568beea9a690b64f63250
SHA1

13ce52e102b7935ca40e159ee4772d7d075efc31
SHA256

4eaf9580c8b48e93ef3d107417522f1039a21e3af76873a7d0ef41e55d226ba9
SHA512

e4fca7f225a34045ca0fb21ae8c6a4343089971aa14c9234ebb7e4a192ef5bfe317885486c5541bb5205cbfe2ace0cbbc4759db7df86b70009ec3141883b43df
SSDEEP

12288:smW3zBfq3dXsXXFcidN0DFWQ5SwAmWhND9yJz+b1FcMLmp2ATTSsd:smKztGd+XFcidmDFWQ59AmUNJyJqb1FE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4348	208	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 208	484	rundll32.exe	82
PID 484 wrote to memory of 208	484	rundll32.exe	82
PID 484 wrote to memory of 208	484	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.c70dac9ebe3568beea9a690b64f63250.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.c70dac9ebe3568beea9a690b64f63250.dll,#1
  2⤵
  PID:208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 560
    3⤵
    - Program crash
    PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 208 -ip 208
1⤵
PID:4292