7b1ef2bcd9dfa478bd9cb0a4cc0faf781b7a3086520da456766360abba876cbf

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2023 20:14

Target

NEAS.cce527aac7067ee3dc56c0251ed8fa70.dll
Size

1.1MB
MD5

cce527aac7067ee3dc56c0251ed8fa70
SHA1

74fa55cb9d894928968682b025d26c3721a90052
SHA256

7b1ef2bcd9dfa478bd9cb0a4cc0faf781b7a3086520da456766360abba876cbf
SHA512

8978e2aee499bad8ad6cced11df99cb70deaf2a8802975ccf53ddf804ea8b5c26ff0735899f90c6f0b71aa39e229a57ef4e167c072f0fcc1cd653ac008fdcad5
SSDEEP

24576:pKbZYyD/HVRU1Hd5SjJi7AuSfx9M3z1zTX7QsGyQ:pKtzUpntSzuTEgQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
556	4404	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 4404	1060	rundll32.exe	86
PID 1060 wrote to memory of 4404	1060	rundll32.exe	86
PID 1060 wrote to memory of 4404	1060	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cce527aac7067ee3dc56c0251ed8fa70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cce527aac7067ee3dc56c0251ed8fa70.dll,#1
  2⤵
  PID:4404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 628
    3⤵
    - Program crash
    PID:556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4404 -ip 4404
1⤵
PID:3080