40e9bb34ac627f8bc51de4b95856eec6685619c3aec925ce1c1860655ea5eae9

Analysis

max time kernel
142s
max time network
140s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 17:20

Target

NEAS.626c4e04b1d3f175820799c94b5f2bf0.dll
Size

1.4MB
MD5

626c4e04b1d3f175820799c94b5f2bf0
SHA1

890088a0713ef058acf00c62f67f2f242467d09b
SHA256

40e9bb34ac627f8bc51de4b95856eec6685619c3aec925ce1c1860655ea5eae9
SHA512

481eef9d9718fc0e9b36716ccde6a8cc4db578f9d613de77f952889bc1a0c1d851958d37dd5a372a354d5a2ef5e469d52681dfdf64b8ad0023ddfcc4d47e7f77
SSDEEP

24576:QfA7ZxvvcdEsObMBOCzdGxAu3FRO89mtbtmaG2iK+BGAU1PiBDeNgkiWcXyfl44:4IZxUE1bqzdGxAu3FIWmtbtmaG2iK+By

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1840	1720	rundll32.exe	28
PID 1720 wrote to memory of 1840	1720	rundll32.exe	28
PID 1720 wrote to memory of 1840	1720	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.626c4e04b1d3f175820799c94b5f2bf0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1720 -s 84
  2⤵
  PID:1840

memory/1720-0-0x000007FEF6590000-0x000007FEF6695000-memory.dmp

Filesize
1.0MB

Download