ac17ccc68746876b7a39d68503cc7ff55753d23473efef784c52f40d541f2dec

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16-10-2023 18:15

Target

NEAS.2baef0e1d6fb057f0db9fa379d275e70.dll
Size

248KB
MD5

2baef0e1d6fb057f0db9fa379d275e70
SHA1

398ed2c67b34db3f467b9641328e92e9993d82d2
SHA256

ac17ccc68746876b7a39d68503cc7ff55753d23473efef784c52f40d541f2dec
SHA512

244706810e96ac2ba75829ec325df82faa643c31ab2b51618d78240da4e249a3d6fbee11a0728dd459b00cbcaacf2dbcc9bffe53d2a93f09b03a6e3ac48fd21c
SSDEEP

6144:wqMmee6ICfPQAX5/6HVtDA6ZZ61Sckxi/flPoS:TMSbCfIHkUs1SlxilPoS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2116	2224	rundll32.exe	28
PID 2224 wrote to memory of 2116	2224	rundll32.exe	28
PID 2224 wrote to memory of 2116	2224	rundll32.exe	28
PID 2224 wrote to memory of 2116	2224	rundll32.exe	28
PID 2224 wrote to memory of 2116	2224	rundll32.exe	28
PID 2224 wrote to memory of 2116	2224	rundll32.exe	28
PID 2224 wrote to memory of 2116	2224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2baef0e1d6fb057f0db9fa379d275e70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2baef0e1d6fb057f0db9fa379d275e70.dll,#1
  2⤵
  PID:2116