0196cdc4489fb4d202f48c426f257b38b85cab8e5250734cd6e112f4eeb35abd

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 08:39

Target

NEAS.28a194bf8a0715911670350d6bce49f0.dll
Size

88KB
MD5

28a194bf8a0715911670350d6bce49f0
SHA1

639d480dfda23ae95904303b5b4cb55989aabf7b
SHA256

0196cdc4489fb4d202f48c426f257b38b85cab8e5250734cd6e112f4eeb35abd
SHA512

83db1347adb2848ce356f80c486f48304175a9b6a451a668d08ed6c847092dcb872283d34c2c71b8cfa25c122e52b9be35e64f7a86dea3b2469f34c96a99a179
SSDEEP

768:07lbVGV/LM6bsSZLt/HkOKip0Vtb01xd5Ieq27lLmoeJS:Y6VZLNHP6tAqgLB7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2908	2076	rundll32.exe	28
PID 2076 wrote to memory of 2908	2076	rundll32.exe	28
PID 2076 wrote to memory of 2908	2076	rundll32.exe	28
PID 2076 wrote to memory of 2908	2076	rundll32.exe	28
PID 2076 wrote to memory of 2908	2076	rundll32.exe	28
PID 2076 wrote to memory of 2908	2076	rundll32.exe	28
PID 2076 wrote to memory of 2908	2076	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.28a194bf8a0715911670350d6bce49f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.28a194bf8a0715911670350d6bce49f0.dll,#1
  2⤵
  PID:2908