883a835def8df77652549d9299211745b5c8d423804eed0d76d691b11006c8f1 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:18

Sharing

Report Analysis Logs

General

Target

NEAS.40e411d291ffdf6650bd9c6953272bc0.dll
Size

3KB
MD5

40e411d291ffdf6650bd9c6953272bc0
SHA1

a28245ddb0b42eeec061f85e461ec4a8dceb4a61
SHA256

883a835def8df77652549d9299211745b5c8d423804eed0d76d691b11006c8f1
SHA512

f192bc32a3056be0426aadfb9442d0fec87ca80e4ad15fc93a7df70b2bc7b2cb3844015a4b02758a3d9de457e293a2b3d5507d3a89789f429f32841ea3a5d092

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 296 wrote to memory of 2112	296	rundll32.exe	28
PID 296 wrote to memory of 2112	296	rundll32.exe	28
PID 296 wrote to memory of 2112	296	rundll32.exe	28
PID 296 wrote to memory of 2112	296	rundll32.exe	28
PID 296 wrote to memory of 2112	296	rundll32.exe	28
PID 296 wrote to memory of 2112	296	rundll32.exe	28
PID 296 wrote to memory of 2112	296	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.40e411d291ffdf6650bd9c6953272bc0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.40e411d291ffdf6650bd9c6953272bc0.dll,#1
  2⤵
  PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads