2afb0a21cf628654f5446d0ead7b814522de6a5cd0ab2fe58ade036d2bd50e43 | Triage

Analysis

max time kernel
122s
max time network
151s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.17bf3b63e575c7517160f6a2c940fef0.dll
Size

6KB
MD5

17bf3b63e575c7517160f6a2c940fef0
SHA1

57e419605c3e2a9845837ec5033ef10440da4d33
SHA256

2afb0a21cf628654f5446d0ead7b814522de6a5cd0ab2fe58ade036d2bd50e43
SHA512

5e8e4735983e1eb0554e51d8722e0b543283c5c7577a4eb81ba0bb4ddbd6c7d05b80bab0b9efbe97667cf7d1cece30b92e74beb65fd98e86654d53730d02d385
SSDEEP

48:6DOdd5YVOiFVE/y/sqwokyJyi0+B+BDq9J5S9:piFVE/y6okJyB+FqX5S9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2264	1696	rundll32.exe	28
PID 1696 wrote to memory of 2264	1696	rundll32.exe	28
PID 1696 wrote to memory of 2264	1696	rundll32.exe	28
PID 1696 wrote to memory of 2264	1696	rundll32.exe	28
PID 1696 wrote to memory of 2264	1696	rundll32.exe	28
PID 1696 wrote to memory of 2264	1696	rundll32.exe	28
PID 1696 wrote to memory of 2264	1696	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.17bf3b63e575c7517160f6a2c940fef0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.17bf3b63e575c7517160f6a2c940fef0.dll,#1
  2⤵
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads