45f3ec7031665f9396fd3ecdc09cc0ebc165cf20e22f519705fe3ff4d600db2c

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 18:39

Target

NEAS.d1ee037e4f03113cfcc2eea5f0ff5ea0.dll
Size

47KB
MD5

d1ee037e4f03113cfcc2eea5f0ff5ea0
SHA1

00cf9c772ed7b1418438ebbde8d60705ec33bbb5
SHA256

45f3ec7031665f9396fd3ecdc09cc0ebc165cf20e22f519705fe3ff4d600db2c
SHA512

8eed064293206a9a535353b9283f80bd30a587155b006ba7447694e2e7ac394545d6012b5640fe6467e7f1368012c4b6fcd93ae4c436e8cc6d09dd9979ec54c3
SSDEEP

768:Wbw7JzXABhybtbzLZDI/F18DnmmvzWZBHMUlbWzEsqC7I/MHy4phWGGlL00Trs/W:WbIzXABatbFWF+D/zYBVlbWzgGyKhWG8

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1456	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 1456	3136	rundll32.exe	82
PID 3136 wrote to memory of 1456	3136	rundll32.exe	82
PID 3136 wrote to memory of 1456	3136	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d1ee037e4f03113cfcc2eea5f0ff5ea0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d1ee037e4f03113cfcc2eea5f0ff5ea0.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1456