630293809787e2417f4d59367acdd77ee645eb651adeed7772de78e625753288 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:19

Sharing

Report Analysis Logs

General

Target

NEAS.48c320f7e82b153c519b6a0ad856e430.dll
Size

3KB
MD5

48c320f7e82b153c519b6a0ad856e430
SHA1

a02847d508a6e2eff93e5907164c98bb29d57568
SHA256

630293809787e2417f4d59367acdd77ee645eb651adeed7772de78e625753288
SHA512

870616c762a7745c26e787c6bcf9a30280ff07ccf305df735b984e2067cf5f653e51cd0a665a00e616ab480408c8f40899be92da9e9db30dcc22f2eb64239721

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2032	2068	rundll32.exe	28
PID 2068 wrote to memory of 2032	2068	rundll32.exe	28
PID 2068 wrote to memory of 2032	2068	rundll32.exe	28
PID 2068 wrote to memory of 2032	2068	rundll32.exe	28
PID 2068 wrote to memory of 2032	2068	rundll32.exe	28
PID 2068 wrote to memory of 2032	2068	rundll32.exe	28
PID 2068 wrote to memory of 2032	2068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.48c320f7e82b153c519b6a0ad856e430.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.48c320f7e82b153c519b6a0ad856e430.dll,#1
  2⤵
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads