8a1f89bd007bab407e3ef1886cf751cb09b56323a72277b6c7bf4360f14281e8 | Triage

Analysis

max time kernel
130s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 17:26

Sharing

Report Analysis Logs

General

Target

NEAS.b8334f840b24cd3b42d7b05632d8fac0.dll
Size

7KB
MD5

b8334f840b24cd3b42d7b05632d8fac0
SHA1

bfd57283406186b14340de99f0a15ef20265a3dd
SHA256

8a1f89bd007bab407e3ef1886cf751cb09b56323a72277b6c7bf4360f14281e8
SHA512

72cb99578ca5da57fda624a5fe9ae1a5987829e43c25501ac8c1a83fc5ccf38e519f90de893b55e0f572e1bc29e0e6ec2ba51b3410ac40ea5dd83670d1dca800
SSDEEP

96:VGEETrMLH5Rlk5n9B/+jreEbsy7FJ4DTO3a4RZi6:efMflkl9BIJxJuii6

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3452	2156	rundll32.exe	86
PID 2156 wrote to memory of 3452	2156	rundll32.exe	86
PID 2156 wrote to memory of 3452	2156	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.b8334f840b24cd3b42d7b05632d8fac0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.b8334f840b24cd3b42d7b05632d8fac0.dll,#1
  2⤵
  PID:3452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads