536d7f3d4a0ef239fd53a0012d933976c80d0dda608100bc095706f159f337f7

Analysis

max time kernel
167s
max time network
147s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 13:58

Target

NEAS.413cd23840caacc9a56a2c2c31fd44d0.dll
Size

87KB
MD5

413cd23840caacc9a56a2c2c31fd44d0
SHA1

9cd8d374c3ca54a85986d913c5c7db0e58cb33c4
SHA256

536d7f3d4a0ef239fd53a0012d933976c80d0dda608100bc095706f159f337f7
SHA512

c95fc46d5feb7c7bc301390351a0d1fec022aa55be65c360f7a05d59f83c771eacdf850e39955793a4e5e5d792af85de84778cc448da1efbaaedfb2e6e1b45be
SSDEEP

1536:hQQ2STKNVPcVcTkOuvjfvpN0gmb6ENEEV0gdO1M9:hQQ2SON5BTSbfvpWgQ6Q0QO1M9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	2800	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2800	2784	rundll32.exe	29
PID 2784 wrote to memory of 2800	2784	rundll32.exe	29
PID 2784 wrote to memory of 2800	2784	rundll32.exe	29
PID 2784 wrote to memory of 2800	2784	rundll32.exe	29
PID 2784 wrote to memory of 2800	2784	rundll32.exe	29
PID 2784 wrote to memory of 2800	2784	rundll32.exe	29
PID 2784 wrote to memory of 2800	2784	rundll32.exe	29
PID 2800 wrote to memory of 2944	2800	rundll32.exe	30
PID 2800 wrote to memory of 2944	2800	rundll32.exe	30
PID 2800 wrote to memory of 2944	2800	rundll32.exe	30
PID 2800 wrote to memory of 2944	2800	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.413cd23840caacc9a56a2c2c31fd44d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.413cd23840caacc9a56a2c2c31fd44d0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 244
    3⤵
    - Program crash
    PID:2944

memory/2800-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download