6ef7d6385c1aaf638da3449ccf118a481d730284e24812c1fb06e59112b00139

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 17:23

Target

NEAS.8b80886400f63d27bbebfff16e3578e0.dll
Size

201KB
MD5

8b80886400f63d27bbebfff16e3578e0
SHA1

f051e85c6d4387bb75727233fcbeaf0b029a3e6a
SHA256

6ef7d6385c1aaf638da3449ccf118a481d730284e24812c1fb06e59112b00139
SHA512

4262a4a9d811c4e30d80510f33ca19633ac9b6a11d092196b924da85b0ee086afe702414c46f6f9eff65ffdb5c7083d07a7964be36f6d5c6961c37ca6c276c4b
SSDEEP

3072:T/8ZWvLlpCo5jd2eooZBDD9Q1m1Jbr1HQXlrkPebZOARk5apiI:T/9+kjkeouDD9J11wX1ZbZOAFpV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2700	5076	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 5076	2560	rundll32.exe	89
PID 2560 wrote to memory of 5076	2560	rundll32.exe	89
PID 2560 wrote to memory of 5076	2560	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.8b80886400f63d27bbebfff16e3578e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.8b80886400f63d27bbebfff16e3578e0.dll,#1
  2⤵
  PID:5076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 608
    3⤵
    - Program crash
    PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5076 -ip 5076
1⤵
PID:1624