f51b366c9d2584bf5f4870a2a4921ddaa5f8558f5f1abf84776c7c4170e39dc8

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 12:04

Target

NEAS.d0733fffbef4c2878c71b825d9cccbe0.dll
Size

264KB
MD5

d0733fffbef4c2878c71b825d9cccbe0
SHA1

eb81e6c54578a94f3de041c5fbab965ac18dbccc
SHA256

f51b366c9d2584bf5f4870a2a4921ddaa5f8558f5f1abf84776c7c4170e39dc8
SHA512

e61e84219dd828c1c1e4cebfa3d99efc0fc0eebb002c5ca5488a6db3de1f78ca3211f77b7acd99982b9a50f2aad60badf459ac1d3bbcdfb0905c0045380d7248
SSDEEP

6144:QMOhmHTDmxF/j6jqihnoy4miw5fXLZYQfc:yheDmxIuihnoyX/LZK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1716	2520	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2520	1676	rundll32.exe	28
PID 1676 wrote to memory of 2520	1676	rundll32.exe	28
PID 1676 wrote to memory of 2520	1676	rundll32.exe	28
PID 1676 wrote to memory of 2520	1676	rundll32.exe	28
PID 1676 wrote to memory of 2520	1676	rundll32.exe	28
PID 1676 wrote to memory of 2520	1676	rundll32.exe	28
PID 1676 wrote to memory of 2520	1676	rundll32.exe	28
PID 2520 wrote to memory of 1716	2520	rundll32.exe	29
PID 2520 wrote to memory of 1716	2520	rundll32.exe	29
PID 2520 wrote to memory of 1716	2520	rundll32.exe	29
PID 2520 wrote to memory of 1716	2520	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d0733fffbef4c2878c71b825d9cccbe0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.d0733fffbef4c2878c71b825d9cccbe0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 220
    3⤵
    - Program crash
    PID:1716

memory/2520-0-0x0000000000660000-0x00000000006A6000-memory.dmp

Filesize
280KB

Download
memory/2520-1-0x0000000000660000-0x00000000006A6000-memory.dmp

Filesize
280KB

Download