18251e0436df2d92e8e13d3be844dcff4c386e660fe36bebda4fd3fa3c74922e

Analysis

max time kernel
137s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2023 11:44

Target

NEAS.ccb9f6300f3c7d2fb413090f15a8b720.dll
Size

6KB
MD5

ccb9f6300f3c7d2fb413090f15a8b720
SHA1

47f94b9c13c97c16e0c3ea11e504a68142b4c6e5
SHA256

18251e0436df2d92e8e13d3be844dcff4c386e660fe36bebda4fd3fa3c74922e
SHA512

7613214abf13e45d55d532fe0700085721233717ba42b7f03a23a9edbb9ecc1b4fb33cd594f6142c2e8a43b71a995b405831a2b3eb293d562796002998f95235
SSDEEP

96:nEY2RrF1eqwi4fN5QeKoYGphJGCI4W2m996QuBVSFl:EHRh1eppfN5QvB6I4mFIST

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3636	4128	rundll32.exe	52
PID 4128 wrote to memory of 3636	4128	rundll32.exe	52
PID 4128 wrote to memory of 3636	4128	rundll32.exe	52

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ccb9f6300f3c7d2fb413090f15a8b720.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ccb9f6300f3c7d2fb413090f15a8b720.dll,#1
  2⤵
  PID:3636