Analysis
-
max time kernel
109s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2023 21:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.cdfca4e1e03fd2686e4d6127852b67a0.dll
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
General
-
Target
NEAS.cdfca4e1e03fd2686e4d6127852b67a0.dll
-
Size
511KB
-
MD5
cdfca4e1e03fd2686e4d6127852b67a0
-
SHA1
1bd522300c449c46657f774665887b68597093b0
-
SHA256
2096455bbb8483c4e490be81e5ed38f1f1b4fb32b6dda55a80a3ff01797acc27
-
SHA512
c563011c44c3ec1ebd3ff12002688472090771656c15255dc2962f9347db55a482406713e96ce0018d3692a325f9832f4d9bb04657406620564b8a7425cba9d7
-
SSDEEP
6144:o6C5AXbMn7UI1FoV2gwTBlrIckPJYYYYYYYYYYYYa:o6RI1Fo/wT3cJYYYYYYYYYYYYa
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3492 wrote to memory of 1724 3492 rundll32.exe 84 PID 3492 wrote to memory of 1724 3492 rundll32.exe 84 PID 3492 wrote to memory of 1724 3492 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cdfca4e1e03fd2686e4d6127852b67a0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cdfca4e1e03fd2686e4d6127852b67a0.dll,#12⤵PID:1724
-
Network
-
Remote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request8.3.197.209.in-addr.arpaIN PTRResponse8.3.197.209.in-addr.arpaIN PTRvip0x008map2sslhwcdnnet
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request21.236.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
No results found
-
72 B 146 B 1 1
DNS Request
157.123.68.40.in-addr.arpa
-
70 B 111 B 1 1
DNS Request
8.3.197.209.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.160.190.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
88.156.103.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
21.236.111.52.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa