3d53f02559f8023799ab5d86b254dc22da600efaf06b6a074a3ef80bd7d2a31d | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:35

Sharing

Report Analysis Logs

General

Target

NEAS.e6a2d2308dc2482af1c555b586738750.dll
Size

5KB
MD5

e6a2d2308dc2482af1c555b586738750
SHA1

d0d665dd6be9b6d1285f32baa915bb9b7af2d6d4
SHA256

3d53f02559f8023799ab5d86b254dc22da600efaf06b6a074a3ef80bd7d2a31d
SHA512

d3efa0047e069cc69aeec15953fb776ce3f6257195cc27340f1e053aa096920a9427227d177b30f92fdc8373027b17121da061cfe41aacb1d41a46973dbfdbab
SSDEEP

96:hy859x0P8Ma6WHFHJXbZNOjhlB1u1Mcryx:F5oL6HFHJXa11u1Mc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2304	1640	rundll32.exe	28
PID 1640 wrote to memory of 2304	1640	rundll32.exe	28
PID 1640 wrote to memory of 2304	1640	rundll32.exe	28
PID 1640 wrote to memory of 2304	1640	rundll32.exe	28
PID 1640 wrote to memory of 2304	1640	rundll32.exe	28
PID 1640 wrote to memory of 2304	1640	rundll32.exe	28
PID 1640 wrote to memory of 2304	1640	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.e6a2d2308dc2482af1c555b586738750.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.e6a2d2308dc2482af1c555b586738750.dll,#1
  2⤵
  PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads