Analysis
-
max time kernel
14s -
max time network
28s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 13:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.293826bab52c52b85a29f28ac3aaf6e0.dll
Resource
win7-20231020-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.293826bab52c52b85a29f28ac3aaf6e0.dll
Resource
win10v2004-20231023-en
1 signatures
150 seconds
General
-
Target
NEAS.293826bab52c52b85a29f28ac3aaf6e0.dll
-
Size
374KB
-
MD5
293826bab52c52b85a29f28ac3aaf6e0
-
SHA1
4b82c99119b707706385267dc666ba34bc75341a
-
SHA256
043c39a25586f44f3c42f92a77b11aae7465afb2433c2413b5b1c30947960e3e
-
SHA512
438740806d0db1e5376974a58cf8fe09cb3b9d0073bb9a6bcebfafab83a2096e007793276d8708fddcd3f2ed1685805cf2794b65b8941762c8926cd91fd08b85
-
SSDEEP
6144:dShDHAzdj5Dodmm4IQzyNx+UMDKMrcTR5yUseB/K:YhLAzF5DodKMNxlMDKMQRZF/K
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2848 1800 rundll32.exe 28 PID 1800 wrote to memory of 2848 1800 rundll32.exe 28 PID 1800 wrote to memory of 2848 1800 rundll32.exe 28 PID 1800 wrote to memory of 2848 1800 rundll32.exe 28 PID 1800 wrote to memory of 2848 1800 rundll32.exe 28 PID 1800 wrote to memory of 2848 1800 rundll32.exe 28 PID 1800 wrote to memory of 2848 1800 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.293826bab52c52b85a29f28ac3aaf6e0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.293826bab52c52b85a29f28ac3aaf6e0.dll,#12⤵PID:2848
-