0e6e84940666f91636c6d54fb44c3c796d8c6081496d4c1b3e3cac9bc133f2c9

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 16:46

Target

NEAS.034884192b8991afe23040b138abd960.dll
Size

5.5MB
MD5

034884192b8991afe23040b138abd960
SHA1

a116b8656efe35471940394dde906008b673df52
SHA256

0e6e84940666f91636c6d54fb44c3c796d8c6081496d4c1b3e3cac9bc133f2c9
SHA512

20388e27c2364edfecf926937c7e1fbd5332de015a3acfc65a7fffd9394a48eadfa787d573385c2ad728c0af357b1cacd888a814a6cf27f07dc5c8cc99dc97b6
SSDEEP

98304:dOOD636bH+bgafsZP/adWhgg7anyhBhSlxmvpa8+0yh3bGsNq5zC:db6KbH+bgafslCwuU+0u3bGQq5m

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2244	1912	rundll32.exe	28
PID 1912 wrote to memory of 2244	1912	rundll32.exe	28
PID 1912 wrote to memory of 2244	1912	rundll32.exe	28
PID 1912 wrote to memory of 2244	1912	rundll32.exe	28
PID 1912 wrote to memory of 2244	1912	rundll32.exe	28
PID 1912 wrote to memory of 2244	1912	rundll32.exe	28
PID 1912 wrote to memory of 2244	1912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.034884192b8991afe23040b138abd960.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.034884192b8991afe23040b138abd960.dll,#1
  2⤵
  PID:2244