e6b652a9280afd6d0c35dcd08d9250b829d0dad50de93dd4960e3137688d7920 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:14

Sharing

Report Analysis Logs

General

Target

NEAS.1a08169c69bec6d14f620ceb58393760.dll
Size

6KB
MD5

1a08169c69bec6d14f620ceb58393760
SHA1

f1116247cca32202027c3b813d868bfcb85d22f6
SHA256

e6b652a9280afd6d0c35dcd08d9250b829d0dad50de93dd4960e3137688d7920
SHA512

11b268edff2587126e1d2f067c55a8f93af8a2651c59a27586341c550fb94b0398edc572e8e2e48fc0728f2679b6ca4d43134e3fca66179d9cce6ccf02835c49
SSDEEP

96:hy859x0P8Maj3myf5LXXUzHu/pkhxbBCS7vuq:F5oLQmyxmHzxVWq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 3016	2020	rundll32.exe	28
PID 2020 wrote to memory of 3016	2020	rundll32.exe	28
PID 2020 wrote to memory of 3016	2020	rundll32.exe	28
PID 2020 wrote to memory of 3016	2020	rundll32.exe	28
PID 2020 wrote to memory of 3016	2020	rundll32.exe	28
PID 2020 wrote to memory of 3016	2020	rundll32.exe	28
PID 2020 wrote to memory of 3016	2020	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.1a08169c69bec6d14f620ceb58393760.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.1a08169c69bec6d14f620ceb58393760.dll,#1
  2⤵
  PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads