744dd16b1bf7638f9783b1ca1152317db91649da55fe0c6e933807920b58ab0c

Analysis

max time kernel
111s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2023 19:55

Target

NEAS.60a8cf59af8870a631a296f3ce659d80.dll
Size

684KB
MD5

60a8cf59af8870a631a296f3ce659d80
SHA1

812a542b235932ff7a5d2ecb04e7661fb7f661b2
SHA256

744dd16b1bf7638f9783b1ca1152317db91649da55fe0c6e933807920b58ab0c
SHA512

fe91859004f3f1a28990c76482a66d229ee7099a0e2e1b8838bb2d1ecf168a374da37c0500b5f598788b4870db5181700174c4108756a27a65211a802547244e
SSDEEP

12288:COxqH0xfk6JvFWAW7WdNY8/h3hFHvPRxvtQLx6ewSfMdsF447na:CaqUxfkUWATdN/h3jRSx6ewSfQO7n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	8	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 8	5092	rundll32.exe	89
PID 5092 wrote to memory of 8	5092	rundll32.exe	89
PID 5092 wrote to memory of 8	5092	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.60a8cf59af8870a631a296f3ce659d80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.60a8cf59af8870a631a296f3ce659d80.dll,#1
  2⤵
  PID:8
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 608
    3⤵
    - Program crash
    PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8 -ip 8
1⤵
PID:2736