6ab150184c9cc2133b60567dcf5ee91181b72834654ce70295b96b5606e8c55d

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
05/11/2023, 07:22

Target

NEAS.2cc018698fe084fce7aa53e8244c8a80.dll
Size

6KB
MD5

2cc018698fe084fce7aa53e8244c8a80
SHA1

33c4214b42fc51450450c678a448f2503ac760a6
SHA256

6ab150184c9cc2133b60567dcf5ee91181b72834654ce70295b96b5606e8c55d
SHA512

746719b678157a9f945d37aedc11560de4d90428312ad1bb35a7ff5d5f5ad2032554d953d8d2fb1257bdb05b1f83b512cb8cd1d30190529d42136f6743eb028c
SSDEEP

96:hy859x0P8Mag81rl+FMlYATFM1l3jckRbnw0kw9VcfHI9HttwC2O6/:F5oLcrlPCUcjwHw9efoJPx6/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 2264	1212	rundll32.exe	27
PID 1212 wrote to memory of 2264	1212	rundll32.exe	27
PID 1212 wrote to memory of 2264	1212	rundll32.exe	27
PID 1212 wrote to memory of 2264	1212	rundll32.exe	27
PID 1212 wrote to memory of 2264	1212	rundll32.exe	27
PID 1212 wrote to memory of 2264	1212	rundll32.exe	27
PID 1212 wrote to memory of 2264	1212	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2cc018698fe084fce7aa53e8244c8a80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2cc018698fe084fce7aa53e8244c8a80.dll,#1
  2⤵
  PID:2264