6ef7d6385c1aaf638da3449ccf118a481d730284e24812c1fb06e59112b00139

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 17:23

Target

NEAS.8b80886400f63d27bbebfff16e3578e0.dll
Size

201KB
MD5

8b80886400f63d27bbebfff16e3578e0
SHA1

f051e85c6d4387bb75727233fcbeaf0b029a3e6a
SHA256

6ef7d6385c1aaf638da3449ccf118a481d730284e24812c1fb06e59112b00139
SHA512

4262a4a9d811c4e30d80510f33ca19633ac9b6a11d092196b924da85b0ee086afe702414c46f6f9eff65ffdb5c7083d07a7964be36f6d5c6961c37ca6c276c4b
SSDEEP

3072:T/8ZWvLlpCo5jd2eooZBDD9Q1m1Jbr1HQXlrkPebZOARk5apiI:T/9+kjkeouDD9J11wX1ZbZOAFpV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	1916	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1916	2000	rundll32.exe	28
PID 2000 wrote to memory of 1916	2000	rundll32.exe	28
PID 2000 wrote to memory of 1916	2000	rundll32.exe	28
PID 2000 wrote to memory of 1916	2000	rundll32.exe	28
PID 2000 wrote to memory of 1916	2000	rundll32.exe	28
PID 2000 wrote to memory of 1916	2000	rundll32.exe	28
PID 2000 wrote to memory of 1916	2000	rundll32.exe	28
PID 1916 wrote to memory of 2192	1916	rundll32.exe	29
PID 1916 wrote to memory of 2192	1916	rundll32.exe	29
PID 1916 wrote to memory of 2192	1916	rundll32.exe	29
PID 1916 wrote to memory of 2192	1916	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.8b80886400f63d27bbebfff16e3578e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.8b80886400f63d27bbebfff16e3578e0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 228
    3⤵
    - Program crash
    PID:2192