956422a0669e430b89698151fc7b63e57cda383ffdf1c27cb9ef97c842fd6cfd

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2023, 21:15

Target

NEAS.26eb75a050386fc88b08350247102b00.dll
Size

1.1MB
MD5

26eb75a050386fc88b08350247102b00
SHA1

0815e3f084fe734ab4e35e1df4356279c785601c
SHA256

956422a0669e430b89698151fc7b63e57cda383ffdf1c27cb9ef97c842fd6cfd
SHA512

f5ea8cfeec4a208c1af55c2bed9933a30cbb152f81138ab9001b9d98383e77a8b3018a24396706e60c6e57f2c0b3ba71ab13fb20e057e4ab295987bd4fd0846d
SSDEEP

24576:Q9T9vBtJxiTHXWVlBBqKucN8Ehqgw1oBW10Rft7:Q9TVAklPucaEhqb0RV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 4748	1308	regsvr32.exe	84
PID 1308 wrote to memory of 4748	1308	regsvr32.exe	84
PID 1308 wrote to memory of 4748	1308	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.26eb75a050386fc88b08350247102b00.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NEAS.26eb75a050386fc88b08350247102b00.dll
  2⤵
  PID:4748

memory/4748-0-0x0000000002800000-0x000000000285A000-memory.dmp

Filesize
360KB

Download
memory/4748-1-0x0000000002800000-0x000000000285A000-memory.dmp

Filesize
360KB

Download