69a88c729dac3d5b330430a57fb41dc577f91f0014c7f8928b9af8e8de127c5a | Triage

Analysis

max time kernel
133s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 12:21

Sharing

Report Analysis Logs

General

Target

NEAS.012178850499ae74574900eabfb93f00.dll
Size

124KB
MD5

012178850499ae74574900eabfb93f00
SHA1

4e630e759ea34c66a5f5520de1ef5b601ab6e86b
SHA256

69a88c729dac3d5b330430a57fb41dc577f91f0014c7f8928b9af8e8de127c5a
SHA512

a23062e1f2319a9bb30caecd793e983f83991d7f35732dfd62e044f900594598fb478988c7badee0a9508d5e4d8bd50051335df7ee240ba275ff43bfde3a4d8c
SSDEEP

1536:GpqYQt5QVfUO2adIczBFdk+JY6jj8S8Qt:wI2xRzBPk2Nj8zM

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 936	2348	regsvr32.exe	87
PID 2348 wrote to memory of 936	2348	regsvr32.exe	87
PID 2348 wrote to memory of 936	2348	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.012178850499ae74574900eabfb93f00.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NEAS.012178850499ae74574900eabfb93f00.dll
  2⤵
  PID:936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/936-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download