d0e4b55a0e6e08b312f825e1555db9aac3bc94a8eb7985e8daa98c8546a8b8c7

Analysis

max time kernel
182s
max time network
237s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 17:14

Target

NEAS.19774d94ab4ec3efe6e89bbf10721000.dll
Size

172KB
MD5

19774d94ab4ec3efe6e89bbf10721000
SHA1

d3765af62bc7f65e2eafbda4d734d3b2e7aadb9c
SHA256

d0e4b55a0e6e08b312f825e1555db9aac3bc94a8eb7985e8daa98c8546a8b8c7
SHA512

85131a76e920349f5dce79a8d06c7e174c3838459f18c65636e7ec39d4ae511c91fa73a2291a1270b10f0a4ac55f0778900f3e237bd92b46a45f344ba508752d
SSDEEP

3072:z7XAA0vXXGNOrw/MpcjtcKZkjXlDA5PtuO6o0BZ2gBM3/7juNyfMFS:HAAiXXHcpcBXRBO6oiZyiNyfgS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 1856	3732	rundll32.exe	81
PID 3732 wrote to memory of 1856	3732	rundll32.exe	81
PID 3732 wrote to memory of 1856	3732	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.19774d94ab4ec3efe6e89bbf10721000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.19774d94ab4ec3efe6e89bbf10721000.dll,#1
  2⤵
  PID:1856

memory/1856-0-0x0000000000C00000-0x0000000000C73000-memory.dmp

Filesize
460KB

Download
memory/1856-1-0x0000000000C00000-0x0000000000C73000-memory.dmp

Filesize
460KB

Download