8cfbe1e1f67aca92072c598af176a9e21f629e5751012112c81ea76b225a4bff

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 14:11

Target

NEAS.71d42d94cc5a699d4d8906d857f85ea0.dll
Size

172KB
MD5

71d42d94cc5a699d4d8906d857f85ea0
SHA1

6917301494ddce2653e0be69a8a09c919dbfff1e
SHA256

8cfbe1e1f67aca92072c598af176a9e21f629e5751012112c81ea76b225a4bff
SHA512

d936d4ecad162e3c47a01b0dfa08c0106d19a5eb46c4f566cd6b958689f1ef710e2c2cefa5f2bcbd00a311733b3a9a18f247f50c9e97ab597d12a7fd37a6365d
SSDEEP

3072:z7XAA0vXXGNOrw/MpcjtcKZkjXlDA5PtuO6o0BZ2gBM3/7juNyfMFS:HAAiXXHcpcBXRBO6oiZyiNyfgS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2256	2472	rundll32.exe	28
PID 2472 wrote to memory of 2256	2472	rundll32.exe	28
PID 2472 wrote to memory of 2256	2472	rundll32.exe	28
PID 2472 wrote to memory of 2256	2472	rundll32.exe	28
PID 2472 wrote to memory of 2256	2472	rundll32.exe	28
PID 2472 wrote to memory of 2256	2472	rundll32.exe	28
PID 2472 wrote to memory of 2256	2472	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.71d42d94cc5a699d4d8906d857f85ea0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.71d42d94cc5a699d4d8906d857f85ea0.dll,#1
  2⤵
  PID:2256

memory/2256-0-0x0000000000310000-0x0000000000383000-memory.dmp

Filesize
460KB

Download
memory/2256-1-0x0000000000310000-0x0000000000383000-memory.dmp

Filesize
460KB

Download