b1f0b835134d1728695d6161a7df8cb9ccbf02b3ccc51187ddd02c4b1ba5c2c1

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 14:09

Target

NEAS.5c760e33d76a5f50d62c42669eb0a180.dll
Size

7KB
MD5

5c760e33d76a5f50d62c42669eb0a180
SHA1

e705cef15d086716c79d9b4d1729dbeaa771c613
SHA256

b1f0b835134d1728695d6161a7df8cb9ccbf02b3ccc51187ddd02c4b1ba5c2c1
SHA512

1540dd00ac1439921ebba27013e6dec2ac230b48ddd49bc49bd93731fd906c6e0d607b27df287391ebdcadfd45d3180542207a30196281781d74b1a07b1737d7
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWPbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPpq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3032	4908	rundll32.exe	56
PID 4908 wrote to memory of 3032	4908	rundll32.exe	56
PID 4908 wrote to memory of 3032	4908	rundll32.exe	56

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.5c760e33d76a5f50d62c42669eb0a180.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.5c760e33d76a5f50d62c42669eb0a180.dll,#1
  2⤵
  PID:3032