883a835def8df77652549d9299211745b5c8d423804eed0d76d691b11006c8f1 | Triage

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2023, 21:18 UTC

Sharing

Report Analysis Logs

General

Target

NEAS.40e411d291ffdf6650bd9c6953272bc0.dll
Size

3KB
MD5

40e411d291ffdf6650bd9c6953272bc0
SHA1

a28245ddb0b42eeec061f85e461ec4a8dceb4a61
SHA256

883a835def8df77652549d9299211745b5c8d423804eed0d76d691b11006c8f1
SHA512

f192bc32a3056be0426aadfb9442d0fec87ca80e4ad15fc93a7df70b2bc7b2cb3844015a4b02758a3d9de457e293a2b3d5507d3a89789f429f32841ea3a5d092

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 4304	456	rundll32.exe	14
PID 456 wrote to memory of 4304	456	rundll32.exe	14
PID 456 wrote to memory of 4304	456	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.40e411d291ffdf6650bd9c6953272bc0.dll,#1
1⤵
PID:4304

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.40e411d291ffdf6650bd9c6953272bc0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:456

Network

DNS

140.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

140.32.126.40.in-addr.arpa

IN PTR

Response
DNS

43.58.199.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

43.58.199.20.in-addr.arpa

IN PTR

Response
DNS

183.59.114.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

183.59.114.20.in-addr.arpa

IN PTR

Response
DNS

15.164.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.164.165.52.in-addr.arpa

IN PTR

Response
DNS

254.178.238.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

254.178.238.8.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

48.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

48.229.111.52.in-addr.arpa

IN PTR

Response
DNS

210.143.182.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

210.143.182.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

140.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

140.32.126.40.in-addr.arpa
8.8.8.8:53

43.58.199.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

43.58.199.20.in-addr.arpa
8.8.8.8:53

183.59.114.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

183.59.114.20.in-addr.arpa
8.8.8.8:53

15.164.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

15.164.165.52.in-addr.arpa
8.8.8.8:53

254.178.238.8.in-addr.arpa

dns

72 B
126 B
1
1

DNS Request

254.178.238.8.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

48.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

48.229.111.52.in-addr.arpa
8.8.8.8:53

210.143.182.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

210.143.182.52.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads