8fe1e2f79a086ed8ddcb3f56fdb581edd5ae257e43469d2d187abf7182afea84 | Triage

Analysis

max time kernel
90s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.a33c51b44bc426eedd76f4ba0a662fe0.dll
Size

16KB
MD5

a33c51b44bc426eedd76f4ba0a662fe0
SHA1

e6e76a9193e7cc7274d97eb13e5b92b9eb43053d
SHA256

8fe1e2f79a086ed8ddcb3f56fdb581edd5ae257e43469d2d187abf7182afea84
SHA512

df668d804bd5a7b3ff1dddfb1c1c778c4c407bd1f65b1a776be60668f2e9d7ad8d4d1fed311c5238a28ff1a5b740c03041ac0eaacd1e059747ad8965bc46968d
SSDEEP

384:LtT0SWA7/GXmpUNn4iRZhAG4WvYwUmztjbRKZ:JT0qmznB6rwUmRvRY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 2804	224	rundll32.exe	37
PID 224 wrote to memory of 2804	224	rundll32.exe	37
PID 224 wrote to memory of 2804	224	rundll32.exe	37

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.a33c51b44bc426eedd76f4ba0a662fe0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.a33c51b44bc426eedd76f4ba0a662fe0.dll,#1
  2⤵
  PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2804-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2804-1-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download