14e9ad05d44cea49e8dbe8bd60660398dc9ad483c5402ddd64c643d7a1e91c82

Analysis

max time kernel
16s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2023 16:46

Target

NEAS.052b6b42ac27902710613c0ce85b6a00.dll
Size

1.6MB
MD5

052b6b42ac27902710613c0ce85b6a00
SHA1

4d24b9e6d6fc49753b33615b667115bca1da0160
SHA256

14e9ad05d44cea49e8dbe8bd60660398dc9ad483c5402ddd64c643d7a1e91c82
SHA512

9036c03d3f7fcfcc554e4bebc929b2fb320c0cfbfd175d190b0daf6588952c38e138a76b2547d4c2b69402c0ee29bf9ab9f5768610e217c1612c173293bb7199
SSDEEP

24576:5MhE2nhs2Gc6MFpWGz6ljUFjwhQNSLvqhNDUqyWav6e5qKocIlUFvoXDYaaGd:ShPoGsQFjwhWZhYJv6e5TPBuTl

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2736	4263.tmp

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.sfx	4263.tmp
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	4263.tmp

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3944	4956	WerFault.exe	83

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 4956	3756	rundll32.exe	83
PID 3756 wrote to memory of 4956	3756	rundll32.exe	83
PID 3756 wrote to memory of 4956	3756	rundll32.exe	83
PID 4956 wrote to memory of 2736	4956	rundll32.exe	84
PID 4956 wrote to memory of 2736	4956	rundll32.exe	84
PID 4956 wrote to memory of 2736	4956	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.052b6b42ac27902710613c0ce85b6a00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.052b6b42ac27902710613c0ce85b6a00.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\4263.tmp
    C:\Users\Admin\AppData\Local\Temp\4263.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 660
    3⤵
    - Program crash
    PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4956 -ip 4956
1⤵
PID:1816

C:\Users\Admin\AppData\Local\Temp\4263.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
C:\Users\Admin\AppData\Local\Temp\4263.tmp

Filesize
145KB

MD5
c610e7ccd6859872c585b2a85d7dc992

SHA1
362b3d4b72e3add687c209c79b500b7c6a246d46

SHA256
14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

SHA512
8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

Download Submit
memory/4956-0-0x0000000002460000-0x00000000024BC000-memory.dmp

Filesize
368KB

Download
memory/4956-1-0x0000000002460000-0x00000000024BC000-memory.dmp

Filesize
368KB

Download