9e32df2127e1ff8691a80fd68922a6866a098c468ad748a64e8a81a66bad7d37

Analysis

max time kernel
128s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 17:21

Target

NEAS.6f51bc9f59f055f39b75e176c33b92b0.dll
Size

172KB
MD5

6f51bc9f59f055f39b75e176c33b92b0
SHA1

c62a7f6b0e8ee46b6801633805f89062669fea6f
SHA256

9e32df2127e1ff8691a80fd68922a6866a098c468ad748a64e8a81a66bad7d37
SHA512

5d9d10aa7ae8507f9e14d845473d2085bee5e10feee2aba1f6a1c436e4f597297f9f22e33189c9d1b567edcd510d90f41880178a3a11f83e89e979b1e1b43b82
SSDEEP

3072:z7XAA0vXXGNOrw/MpcjtcKZkjXlDA5PtuO6o0BZ2gBM3/7juNyfMFS:HAAiXXHcpcBXRBO6oiZyiNyfgS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 1760	4772	rundll32.exe	86
PID 4772 wrote to memory of 1760	4772	rundll32.exe	86
PID 4772 wrote to memory of 1760	4772	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6f51bc9f59f055f39b75e176c33b92b0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6f51bc9f59f055f39b75e176c33b92b0.dll,#1
  2⤵
  PID:1760

memory/1760-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download