680d64a9fecf671b3b6a44833751db15dc737de072dc552a94065332bab70955 | Triage

Analysis

max time kernel
82s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2023, 21:18

Sharing

Report Analysis Logs

General

Target

NEAS.3da3682a21cdd94823626ef8722efe40.dll
Size

5KB
MD5

3da3682a21cdd94823626ef8722efe40
SHA1

90b9188847f20d303cc21f7b9c96d033143c12dc
SHA256

680d64a9fecf671b3b6a44833751db15dc737de072dc552a94065332bab70955
SHA512

7f3cb3e6974405ed522d2bfa9f601f6c92ce3c6b6fd9e6dd5a3cd04a8efbce35e4c83afca71bb906dff57ed6bc0afc178a3af506a0d84b9674e105608797419a
SSDEEP

96:hy859x0P8MaFpcpkkRKDbbj0WAHLfnjR09:F5oLEeqWKPcHHq

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 4664	2176	rundll32.exe	85
PID 2176 wrote to memory of 4664	2176	rundll32.exe	85
PID 2176 wrote to memory of 4664	2176	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3da3682a21cdd94823626ef8722efe40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3da3682a21cdd94823626ef8722efe40.dll,#1
  2⤵
  PID:4664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads