2af0b63184e6337655ae135747a1f4f36c501b6c9ddf13f0444970bfb8901f96

Analysis

max time kernel
35s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2023 21:28

Target

NEAS.ac6168465cf85773d8d40dad290e6c50.dll
Size

371KB
MD5

ac6168465cf85773d8d40dad290e6c50
SHA1

7d6fc38957c2b06e4e473ce73e54fe925fa73166
SHA256

2af0b63184e6337655ae135747a1f4f36c501b6c9ddf13f0444970bfb8901f96
SHA512

eb2bfd606e99503c8184bdb8c8ae70f0c796d94aa0d0113636562465e423f5f69df8e489b05bd25591db04b6d1457335df6e73d43083cd8d9be747c2454a6d8f
SSDEEP

6144:aYIhSlnDMPqit91zm5VY1TBKZad4BAO3JxxFMDUAnd3mrjay3Jgl8lk:/IhSvktmw1TIWWJxXfAnxeb5gS2

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1768	E762.tmp

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.sfx	E762.tmp
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	E762.tmp
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll	E762.tmp
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll	E762.tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2316	2156	rundll32.exe	83
PID 2156 wrote to memory of 2316	2156	rundll32.exe	83
PID 2156 wrote to memory of 2316	2156	rundll32.exe	83
PID 2316 wrote to memory of 1768	2316	rundll32.exe	84
PID 2316 wrote to memory of 1768	2316	rundll32.exe	84
PID 2316 wrote to memory of 1768	2316	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ac6168465cf85773d8d40dad290e6c50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ac6168465cf85773d8d40dad290e6c50.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Users\Admin\AppData\Local\Temp\E762.tmp
    C:\Users\Admin\AppData\Local\Temp\E762.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:1768

C:\Users\Admin\AppData\Local\Temp\E762.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\E762.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/2316-1-0x0000000002180000-0x00000000021B4000-memory.dmp

Filesize
208KB

Download
memory/2316-0-0x0000000002180000-0x00000000021B4000-memory.dmp

Filesize
208KB

Download
memory/2316-2-0x0000000010000000-0x0000000010063000-memory.dmp

Filesize
396KB

Download
memory/2316-7-0x0000000010000000-0x0000000010063000-memory.dmp

Filesize
396KB

Download