7e3a8da3c73494bd08c402c8f3c257c601f3f1ed5d714d69ba03d5826c1aefd2

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 13:22

Target

NEAS.a9fba3049431ef63f5b451204f3bbe60.dll
Size

133KB
MD5

a9fba3049431ef63f5b451204f3bbe60
SHA1

222e1e5f6125fade7126704e561682f6812169d2
SHA256

7e3a8da3c73494bd08c402c8f3c257c601f3f1ed5d714d69ba03d5826c1aefd2
SHA512

57d5a31cb53bdf5923a26ab79cf12470d1b437a1435399c7309c40813ecd0e5f2e1882f9492c942dcd4ab0fa51fc8fe1de547fc976465d806de3758a35b1991b
SSDEEP

3072:YTLWqZEm1qbfi/oT3jjoUEWEqCYtxwV+OPaqlfVZbfZ:OL1ZEm1qb+m/fVGTf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2788	2244	rundll32.exe	28
PID 2244 wrote to memory of 2788	2244	rundll32.exe	28
PID 2244 wrote to memory of 2788	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.a9fba3049431ef63f5b451204f3bbe60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2244 -s 92
  2⤵
  PID:2788