3fcd0372503c8dc2baefa6f7f9b33567fb62d58ffc4f2cbbe19b7b5885bf613b | Triage

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:15

Sharing

Report Analysis Logs

General

Target

NEAS.25010e70d4e92a78413657838612e100.dll
Size

150KB
MD5

25010e70d4e92a78413657838612e100
SHA1

e7999b5684408a709ddc978aee15ebb66de21839
SHA256

3fcd0372503c8dc2baefa6f7f9b33567fb62d58ffc4f2cbbe19b7b5885bf613b
SHA512

add91542729a8575aa253f25016ed0343c5672fa6a2ebbd338f62a188ac4d5e9f5d157de6831de2ccba752d97a8c5b0c90f3a8c3f3f35804eb2dc1276194999d
SSDEEP

3072:b/2jRbSsWqrWOwYCmotyihpD0BI6XBJficD3wU:U1fBihpDmfIU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2380	2176	rundll32.exe	28
PID 2176 wrote to memory of 2380	2176	rundll32.exe	28
PID 2176 wrote to memory of 2380	2176	rundll32.exe	28
PID 2176 wrote to memory of 2380	2176	rundll32.exe	28
PID 2176 wrote to memory of 2380	2176	rundll32.exe	28
PID 2176 wrote to memory of 2380	2176	rundll32.exe	28
PID 2176 wrote to memory of 2380	2176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.25010e70d4e92a78413657838612e100.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.25010e70d4e92a78413657838612e100.dll,#1
  2⤵
  PID:2380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-0-0x0000000074C20000-0x0000000074C4A000-memory.dmp

Filesize
168KB

Download