536d7f3d4a0ef239fd53a0012d933976c80d0dda608100bc095706f159f337f7

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 13:58

Target

NEAS.413cd23840caacc9a56a2c2c31fd44d0.dll
Size

87KB
MD5

413cd23840caacc9a56a2c2c31fd44d0
SHA1

9cd8d374c3ca54a85986d913c5c7db0e58cb33c4
SHA256

536d7f3d4a0ef239fd53a0012d933976c80d0dda608100bc095706f159f337f7
SHA512

c95fc46d5feb7c7bc301390351a0d1fec022aa55be65c360f7a05d59f83c771eacdf850e39955793a4e5e5d792af85de84778cc448da1efbaaedfb2e6e1b45be
SSDEEP

1536:hQQ2STKNVPcVcTkOuvjfvpN0gmb6ENEEV0gdO1M9:hQQ2SON5BTSbfvpWgQ6Q0QO1M9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	4708	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 4708	3168	rundll32.exe	88
PID 3168 wrote to memory of 4708	3168	rundll32.exe	88
PID 3168 wrote to memory of 4708	3168	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.413cd23840caacc9a56a2c2c31fd44d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.413cd23840caacc9a56a2c2c31fd44d0.dll,#1
  2⤵
  PID:4708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 632
    3⤵
    - Program crash
    PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4708 -ip 4708
1⤵
PID:2320

memory/4708-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download