0e6e84940666f91636c6d54fb44c3c796d8c6081496d4c1b3e3cac9bc133f2c9

Analysis

max time kernel
139s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 16:46

Target

NEAS.034884192b8991afe23040b138abd960.dll
Size

5.5MB
MD5

034884192b8991afe23040b138abd960
SHA1

a116b8656efe35471940394dde906008b673df52
SHA256

0e6e84940666f91636c6d54fb44c3c796d8c6081496d4c1b3e3cac9bc133f2c9
SHA512

20388e27c2364edfecf926937c7e1fbd5332de015a3acfc65a7fffd9394a48eadfa787d573385c2ad728c0af357b1cacd888a814a6cf27f07dc5c8cc99dc97b6
SSDEEP

98304:dOOD636bH+bgafsZP/adWhgg7anyhBhSlxmvpa8+0yh3bGsNq5zC:db6KbH+bgafslCwuU+0u3bGQq5m

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	4436	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4436	4788	rundll32.exe	83
PID 4788 wrote to memory of 4436	4788	rundll32.exe	83
PID 4788 wrote to memory of 4436	4788	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.034884192b8991afe23040b138abd960.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.034884192b8991afe23040b138abd960.dll,#1
  2⤵
  PID:4436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 564
    3⤵
    - Program crash
    PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4436 -ip 4436
1⤵
PID:3300