744dd16b1bf7638f9783b1ca1152317db91649da55fe0c6e933807920b58ab0c

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 19:55

Target

NEAS.60a8cf59af8870a631a296f3ce659d80.dll
Size

684KB
MD5

60a8cf59af8870a631a296f3ce659d80
SHA1

812a542b235932ff7a5d2ecb04e7661fb7f661b2
SHA256

744dd16b1bf7638f9783b1ca1152317db91649da55fe0c6e933807920b58ab0c
SHA512

fe91859004f3f1a28990c76482a66d229ee7099a0e2e1b8838bb2d1ecf168a374da37c0500b5f598788b4870db5181700174c4108756a27a65211a802547244e
SSDEEP

12288:COxqH0xfk6JvFWAW7WdNY8/h3hFHvPRxvtQLx6ewSfMdsF447na:CaqUxfkUWATdN/h3jRSx6ewSfQO7n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	2500	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2500	2192	rundll32.exe	28
PID 2192 wrote to memory of 2500	2192	rundll32.exe	28
PID 2192 wrote to memory of 2500	2192	rundll32.exe	28
PID 2192 wrote to memory of 2500	2192	rundll32.exe	28
PID 2192 wrote to memory of 2500	2192	rundll32.exe	28
PID 2192 wrote to memory of 2500	2192	rundll32.exe	28
PID 2192 wrote to memory of 2500	2192	rundll32.exe	28
PID 2500 wrote to memory of 2456	2500	rundll32.exe	29
PID 2500 wrote to memory of 2456	2500	rundll32.exe	29
PID 2500 wrote to memory of 2456	2500	rundll32.exe	29
PID 2500 wrote to memory of 2456	2500	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.60a8cf59af8870a631a296f3ce659d80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.60a8cf59af8870a631a296f3ce659d80.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 248
    3⤵
    - Program crash
    PID:2456