8b89ca3a26a7f02f8e6002b71b4250d449e9392f75a820eb7cbcd8998c22bf6d

Analysis

max time kernel
116s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 10:36

Target

NEAS.1bd9447139acda01e743bf9e327e90c0.dll
Size

5KB
MD5

1bd9447139acda01e743bf9e327e90c0
SHA1

73d2c608122864cca83cebe77809a0633a854ced
SHA256

8b89ca3a26a7f02f8e6002b71b4250d449e9392f75a820eb7cbcd8998c22bf6d
SHA512

e113af134b0f33ef65a62ccf360c82ca3a592e2f2c9f539a375bd83338f980b0024c2fabceb883b4ebcd00515c263f07596b17cb8cb4c68a9e4901fbaf8063f9
SSDEEP

48:C6VonAHso6U7lYa92RrpjwDmetlG95hx+iMHh2piDth+hsaahTxYiC9hb+4QpIhc:nEY2RrF1eqwi4caxN9pQDan8fUx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 1032	5084	rundll32.exe	40
PID 5084 wrote to memory of 1032	5084	rundll32.exe	40
PID 5084 wrote to memory of 1032	5084	rundll32.exe	40

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.1bd9447139acda01e743bf9e327e90c0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.1bd9447139acda01e743bf9e327e90c0.dll,#1
  2⤵
  PID:1032