02798f7e58425df7cfea4feb22396dcfcd60a3c4626e5857ca95b9473d70b0fe

Analysis

max time kernel
158s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2023 16:50

Target

NEAS.d1cfd16d78bd428f9d3a7d2aba6dc630.dll
Size

172KB
MD5

d1cfd16d78bd428f9d3a7d2aba6dc630
SHA1

643bb345d963a10f37e7ddc4f45787bbb742ebb3
SHA256

02798f7e58425df7cfea4feb22396dcfcd60a3c4626e5857ca95b9473d70b0fe
SHA512

e48a174481619881fb9a20b13b3fc98b81ba8c87e1b38d9c57e40b107db05b392a0806c8efcf809474deeb17f0baeaf038d68b0dd7eb7767577799dda9d818bc
SSDEEP

3072:z7XAA0vXXGNOrw/MpcjtcKZkjXlDA5PtuO6o0BZ2gBM3/7juNyfMFS:HAAiXXHcpcBXRBO6oiZyiNyfgS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 704	2432	rundll32.exe	86
PID 2432 wrote to memory of 704	2432	rundll32.exe	86
PID 2432 wrote to memory of 704	2432	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d1cfd16d78bd428f9d3a7d2aba6dc630.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d1cfd16d78bd428f9d3a7d2aba6dc630.dll,#1
  2⤵
  PID:704

memory/704-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download