574b0a847f5e2e4b408723f184bde1676ab01e659ad81f4266569c60cafe03e3

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 16:47

Target

NEAS.NEASe3ed9d02a3784934b5b6f4cfa9b58010exe.dll
Size

671KB
MD5

e3ed9d02a3784934b5b6f4cfa9b58010
SHA1

ab2a319c55e1de38145f4f28178b790f54f195c9
SHA256

574b0a847f5e2e4b408723f184bde1676ab01e659ad81f4266569c60cafe03e3
SHA512

7d1d1ac3ef7dd2722cd60adee84c90fe40ad88630a55f34bbbcc0636cb19f6a86fffb1f4f1afa837bd3ebd410eba51a71225e25599b083785355674c6683c79e
SSDEEP

12288:HlQXHbjkbigibQM1wh0Azn/NtG86qz01P4UPcOyYzblt59dkEi/P1Tx4:FQrjkbigiscATN41PwYdtfib3pq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4868	4712	rundll32.exe	85
PID 4712 wrote to memory of 4868	4712	rundll32.exe	85
PID 4712 wrote to memory of 4868	4712	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.NEASe3ed9d02a3784934b5b6f4cfa9b58010exe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.NEASe3ed9d02a3784934b5b6f4cfa9b58010exe.dll,#1
  2⤵
  PID:4868

memory/4868-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download