5150090afe18dd8a1fd4fadb5537bc1306da02bca5d830adebbaff065f9fafbf

Analysis

max time kernel
28s
max time network
19s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:26

Target

NEAS.93cc1bb235ccf92d5dcf7d2c256ef030.dll
Size

6KB
MD5

93cc1bb235ccf92d5dcf7d2c256ef030
SHA1

07b264b6ddd571403689d8b1edcf8d7f9089c1a2
SHA256

5150090afe18dd8a1fd4fadb5537bc1306da02bca5d830adebbaff065f9fafbf
SHA512

55b3fccddb8718fb34e7721f0ebda4cf1be587fc14647dff96b89163b4e9bdc2e212449731f892e174826e6ae265a17d13a58b47682adacae6680a7e2e3f3c45
SSDEEP

96:hy859x0P8MaVw8ahCpNAuOA86r6YpDr88v61K2ze+qLYykRXe:F5oLo97A7A86ea88v61weX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2296	3016	rundll32.exe	28
PID 3016 wrote to memory of 2296	3016	rundll32.exe	28
PID 3016 wrote to memory of 2296	3016	rundll32.exe	28
PID 3016 wrote to memory of 2296	3016	rundll32.exe	28
PID 3016 wrote to memory of 2296	3016	rundll32.exe	28
PID 3016 wrote to memory of 2296	3016	rundll32.exe	28
PID 3016 wrote to memory of 2296	3016	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.93cc1bb235ccf92d5dcf7d2c256ef030.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.93cc1bb235ccf92d5dcf7d2c256ef030.dll,#1
  2⤵
  PID:2296