899a11d82f1fedba91972153dbf4898ae4253e79736f0a56763d825dc3ab133e | Triage

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.d34b4df6ce36a8e47d6f30105e31ddf0.dll
Size

3KB
MD5

d34b4df6ce36a8e47d6f30105e31ddf0
SHA1

2b794d5136b0b0f089a0aeb6f2ef67e779b8a472
SHA256

899a11d82f1fedba91972153dbf4898ae4253e79736f0a56763d825dc3ab133e
SHA512

fcfb496e048ac7dc2493b32a2b43900f65ce74f1aa33b41da5499adb707715c312eb6c6f9bee89500ba552fcd387250cf13d9289c913ebcdb5cde2be911e6b21

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 2792	1060	rundll32.exe	27
PID 1060 wrote to memory of 2792	1060	rundll32.exe	27
PID 1060 wrote to memory of 2792	1060	rundll32.exe	27
PID 1060 wrote to memory of 2792	1060	rundll32.exe	27
PID 1060 wrote to memory of 2792	1060	rundll32.exe	27
PID 1060 wrote to memory of 2792	1060	rundll32.exe	27
PID 1060 wrote to memory of 2792	1060	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d34b4df6ce36a8e47d6f30105e31ddf0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d34b4df6ce36a8e47d6f30105e31ddf0.dll,#1
  2⤵
  PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads