9b901417aceb30def4f4bc4abde0a1e7c99d64261f530b14d2f501c7d2bd0e0f

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 08:58

Target

NEAS.cdb235be8269db3592c6fd4d46fd19d0.dll
Size

643KB
MD5

cdb235be8269db3592c6fd4d46fd19d0
SHA1

999bc112e5f856f1535961a5f8908327939aefc2
SHA256

9b901417aceb30def4f4bc4abde0a1e7c99d64261f530b14d2f501c7d2bd0e0f
SHA512

2d4dbeeed451469e2acfce18de90c9a8688124968ffdd40d92041008ec42acfeff744c4e9ed2d831ed8386949eb3cb50e54db55c6d40f0ba9341a67a54e032f0
SSDEEP

6144:gzwDpc+h8qVVLJofd85fOJ81FhlDfPAXLrwXAqZmuBtMKOwGnk5:g0DpcG9VLOfdEOJ81FhJPmFn4pG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2024	2176	rundll32.exe	28
PID 2176 wrote to memory of 2024	2176	rundll32.exe	28
PID 2176 wrote to memory of 2024	2176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cdb235be8269db3592c6fd4d46fd19d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2176 -s 168
  2⤵
  PID:2024