Analysis
-
max time kernel
117s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2023, 18:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.d04263b8bdc537bffc7c936cb1addad0.dll
Resource
win7-20230831-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.d04263b8bdc537bffc7c936cb1addad0.dll
Resource
win10v2004-20230915-en
1 signatures
150 seconds
General
-
Target
NEAS.d04263b8bdc537bffc7c936cb1addad0.dll
-
Size
6KB
-
MD5
d04263b8bdc537bffc7c936cb1addad0
-
SHA1
6f064371f66bf3f67f38a5df588a206308e213f4
-
SHA256
d8280c572983c662f0ff42eb9d41efade751fcd370507299aa5af0f78ece34e7
-
SHA512
2b4d99623337b7d369a9ee956438d90d061bdae8fa0a05c6c2c353533b8991ef2a53cbac12342a8d99f2c0027316dfa351d1f097521bcd44da9ed8b4ce55207f
-
SSDEEP
48:6EQt5YVOSVVEPy+wEMmqiHNpU10IB+BDq9J5SV3DY:CSVVEPozmB7CB+FqX5S1D
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1660 wrote to memory of 4428 1660 rundll32.exe 77 PID 1660 wrote to memory of 4428 1660 rundll32.exe 77 PID 1660 wrote to memory of 4428 1660 rundll32.exe 77
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d04263b8bdc537bffc7c936cb1addad0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d04263b8bdc537bffc7c936cb1addad0.dll,#12⤵PID:4428
-