198430ae4d962432529ddd3356df3ee71e8aa0ca2c57e657c29f5c5e3985b97c | Triage

Analysis

max time kernel
139s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2023 19:57

Sharing

Report Analysis Logs

General

Target

NEAS.89b5dbdaa578305a22abc658cf1a6540.dll
Size

296KB
MD5

89b5dbdaa578305a22abc658cf1a6540
SHA1

49189a240ee27127a6f7e2c56749762f1bcf3529
SHA256

198430ae4d962432529ddd3356df3ee71e8aa0ca2c57e657c29f5c5e3985b97c
SHA512

99e768a8245cfe2366781f67d26a77d36ee02282c0c479dda802ca69d23982d8f636424492f3120a86f7e32222d7c4d73994d06c2fcfb7330465a3cdd79bb0f4
SSDEEP

6144:aoyQHYQb6zeoUXsx10WCIHN2gihpRdVo0:amHYGSx+QHN+7H

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1684	1076	regsvr32.exe	83
PID 1076 wrote to memory of 1684	1076	regsvr32.exe	83
PID 1076 wrote to memory of 1684	1076	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.89b5dbdaa578305a22abc658cf1a6540.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NEAS.89b5dbdaa578305a22abc658cf1a6540.dll
  2⤵
  PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads