7b773cbf1bd4955224837db56118569f5becd328abf5f3c706989bdbebac8165 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
28/10/2023, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.6f3ce1c75575212f941f89c88515b970.dll
Size

3KB
MD5

6f3ce1c75575212f941f89c88515b970
SHA1

5c245a4070510aa7cadaa3edb230cda6acc73b45
SHA256

7b773cbf1bd4955224837db56118569f5becd328abf5f3c706989bdbebac8165
SHA512

7ccd5379574534edd8e4554850252b61d96cb01632c010f8f4349bdc07d030824784f3170a9b69b64fd4f91ea008af81fbdfb67aaa5a22126ae9b9e47be19920

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28
PID 2320 wrote to memory of 2116	2320	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6f3ce1c75575212f941f89c88515b970.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.6f3ce1c75575212f941f89c88515b970.dll,#1
  2⤵
  PID:2116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads