2388b07275b4117e6a3af044f64a2b650ec09aa63d880750a3601f8aa10096d0 | Triage

Analysis

max time kernel
143s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:29

Sharing

Report Analysis Logs

General

Target

NEAS.b76ff12c76ebdf3d0cd1c4dc35f9c370.dll
Size

51KB
MD5

b76ff12c76ebdf3d0cd1c4dc35f9c370
SHA1

08b91a458f3b73d8e653633e101a62ef89d64ab1
SHA256

2388b07275b4117e6a3af044f64a2b650ec09aa63d880750a3601f8aa10096d0
SHA512

d1b03bc4b090efc1273cf710c8a2232112714f5cb2d4e53665e15861cf9e03fe0e6080c12739563f1b8ccdaa5de4378a12cf49d41a8b6735a265029ec645b71f
SSDEEP

384:IbaE2d5OKkjpAU3XdjINLK4iO+EwOlMnSRR8:Ibapd5ha8E3fK8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1800	2252	rundll32.exe	22
PID 2252 wrote to memory of 1800	2252	rundll32.exe	22
PID 2252 wrote to memory of 1800	2252	rundll32.exe	22

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.b76ff12c76ebdf3d0cd1c4dc35f9c370.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2252 -s 84
  2⤵
  PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2252-0-0x0000000074FE0000-0x0000000074FEB000-memory.dmp

Filesize
44KB

Download