8cfbe1e1f67aca92072c598af176a9e21f629e5751012112c81ea76b225a4bff

Analysis

max time kernel
135s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 14:11

Target

NEAS.71d42d94cc5a699d4d8906d857f85ea0.dll
Size

172KB
MD5

71d42d94cc5a699d4d8906d857f85ea0
SHA1

6917301494ddce2653e0be69a8a09c919dbfff1e
SHA256

8cfbe1e1f67aca92072c598af176a9e21f629e5751012112c81ea76b225a4bff
SHA512

d936d4ecad162e3c47a01b0dfa08c0106d19a5eb46c4f566cd6b958689f1ef710e2c2cefa5f2bcbd00a311733b3a9a18f247f50c9e97ab597d12a7fd37a6365d
SSDEEP

3072:z7XAA0vXXGNOrw/MpcjtcKZkjXlDA5PtuO6o0BZ2gBM3/7juNyfMFS:HAAiXXHcpcBXRBO6oiZyiNyfgS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 2656	3624	rundll32.exe	87
PID 3624 wrote to memory of 2656	3624	rundll32.exe	87
PID 3624 wrote to memory of 2656	3624	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.71d42d94cc5a699d4d8906d857f85ea0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.71d42d94cc5a699d4d8906d857f85ea0.dll,#1
  2⤵
  PID:2656

memory/2656-0-0x0000000000860000-0x00000000008D3000-memory.dmp

Filesize
460KB

Download
memory/2656-1-0x0000000000860000-0x00000000008D3000-memory.dmp

Filesize
460KB

Download