680d64a9fecf671b3b6a44833751db15dc737de072dc552a94065332bab70955 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:18

Sharing

Report Analysis Logs

General

Target

NEAS.3da3682a21cdd94823626ef8722efe40.dll
Size

5KB
MD5

3da3682a21cdd94823626ef8722efe40
SHA1

90b9188847f20d303cc21f7b9c96d033143c12dc
SHA256

680d64a9fecf671b3b6a44833751db15dc737de072dc552a94065332bab70955
SHA512

7f3cb3e6974405ed522d2bfa9f601f6c92ce3c6b6fd9e6dd5a3cd04a8efbce35e4c83afca71bb906dff57ed6bc0afc178a3af506a0d84b9674e105608797419a
SSDEEP

96:hy859x0P8MaFpcpkkRKDbbj0WAHLfnjR09:F5oLEeqWKPcHHq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1192	1732	rundll32.exe	28
PID 1732 wrote to memory of 1192	1732	rundll32.exe	28
PID 1732 wrote to memory of 1192	1732	rundll32.exe	28
PID 1732 wrote to memory of 1192	1732	rundll32.exe	28
PID 1732 wrote to memory of 1192	1732	rundll32.exe	28
PID 1732 wrote to memory of 1192	1732	rundll32.exe	28
PID 1732 wrote to memory of 1192	1732	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3da3682a21cdd94823626ef8722efe40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3da3682a21cdd94823626ef8722efe40.dll,#1
  2⤵
  PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads