5ef97d20fa579858315693e2089bafd7f4acbbee2695001cc0aeb6e2008092e9

Analysis

max time kernel
266s
max time network
319s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:19

Target

NEAS.493cfd605164c5d904f6cb81e3d0c300.dll
Size

41KB
MD5

493cfd605164c5d904f6cb81e3d0c300
SHA1

735501c203793f89666c8081f992bea97e2c0b48
SHA256

5ef97d20fa579858315693e2089bafd7f4acbbee2695001cc0aeb6e2008092e9
SHA512

dd8d6b1f45b3eb846fbff7230fcc29e6cd924c8aa4088d7b706b48c411902ed074dbc59b696ffa3d45775e900a921fb768ddcb2b732c6565de9b201c35a6522c
SSDEEP

768:wb0cSeoyqkY5ma78ct+JnQn2cU9k4K0Qyl4h9n+S08Uvt3Xqr3cjCtcnGxPCN:mSe2I2n+S08Uvt38cj4EN

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 1092	2712	rundll32.exe	27
PID 2712 wrote to memory of 1092	2712	rundll32.exe	27
PID 2712 wrote to memory of 1092	2712	rundll32.exe	27
PID 2712 wrote to memory of 1092	2712	rundll32.exe	27
PID 2712 wrote to memory of 1092	2712	rundll32.exe	27
PID 2712 wrote to memory of 1092	2712	rundll32.exe	27
PID 2712 wrote to memory of 1092	2712	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.493cfd605164c5d904f6cb81e3d0c300.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.493cfd605164c5d904f6cb81e3d0c300.dll,#1
  2⤵
  PID:1092