9e32df2127e1ff8691a80fd68922a6866a098c468ad748a64e8a81a66bad7d37

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22-10-2023 17:21

Target

NEAS.6f51bc9f59f055f39b75e176c33b92b0.dll
Size

172KB
MD5

6f51bc9f59f055f39b75e176c33b92b0
SHA1

c62a7f6b0e8ee46b6801633805f89062669fea6f
SHA256

9e32df2127e1ff8691a80fd68922a6866a098c468ad748a64e8a81a66bad7d37
SHA512

5d9d10aa7ae8507f9e14d845473d2085bee5e10feee2aba1f6a1c436e4f597297f9f22e33189c9d1b567edcd510d90f41880178a3a11f83e89e979b1e1b43b82
SSDEEP

3072:z7XAA0vXXGNOrw/MpcjtcKZkjXlDA5PtuO6o0BZ2gBM3/7juNyfMFS:HAAiXXHcpcBXRBO6oiZyiNyfgS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2852	2180	rundll32.exe	28
PID 2180 wrote to memory of 2852	2180	rundll32.exe	28
PID 2180 wrote to memory of 2852	2180	rundll32.exe	28
PID 2180 wrote to memory of 2852	2180	rundll32.exe	28
PID 2180 wrote to memory of 2852	2180	rundll32.exe	28
PID 2180 wrote to memory of 2852	2180	rundll32.exe	28
PID 2180 wrote to memory of 2852	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6f51bc9f59f055f39b75e176c33b92b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6f51bc9f59f055f39b75e176c33b92b0.dll,#1
  2⤵
  PID:2852

memory/2852-0-0x00000000002C0000-0x0000000000333000-memory.dmp

Filesize
460KB

Download
memory/2852-1-0x00000000002C0000-0x0000000000333000-memory.dmp

Filesize
460KB

Download
memory/2852-2-0x00000000002C0000-0x0000000000333000-memory.dmp

Filesize
460KB

Download
memory/2852-3-0x00000000002C0000-0x0000000000333000-memory.dmp

Filesize
460KB

Download