3fcd0372503c8dc2baefa6f7f9b33567fb62d58ffc4f2cbbe19b7b5885bf613b | Triage

Analysis

max time kernel
91s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2023, 21:15

Sharing

Report Analysis Logs

General

Target

NEAS.25010e70d4e92a78413657838612e100.dll
Size

150KB
MD5

25010e70d4e92a78413657838612e100
SHA1

e7999b5684408a709ddc978aee15ebb66de21839
SHA256

3fcd0372503c8dc2baefa6f7f9b33567fb62d58ffc4f2cbbe19b7b5885bf613b
SHA512

add91542729a8575aa253f25016ed0343c5672fa6a2ebbd338f62a188ac4d5e9f5d157de6831de2ccba752d97a8c5b0c90f3a8c3f3f35804eb2dc1276194999d
SSDEEP

3072:b/2jRbSsWqrWOwYCmotyihpD0BI6XBJficD3wU:U1fBihpDmfIU

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 3840	4864	rundll32.exe	84
PID 4864 wrote to memory of 3840	4864	rundll32.exe	84
PID 4864 wrote to memory of 3840	4864	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.25010e70d4e92a78413657838612e100.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.25010e70d4e92a78413657838612e100.dll,#1
  2⤵
  PID:3840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3840-0-0x0000000074CA0000-0x0000000074CCA000-memory.dmp

Filesize
168KB

Download