6ab150184c9cc2133b60567dcf5ee91181b72834654ce70295b96b5606e8c55d

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2023 07:22

Target

NEAS.2cc018698fe084fce7aa53e8244c8a80.dll
Size

6KB
MD5

2cc018698fe084fce7aa53e8244c8a80
SHA1

33c4214b42fc51450450c678a448f2503ac760a6
SHA256

6ab150184c9cc2133b60567dcf5ee91181b72834654ce70295b96b5606e8c55d
SHA512

746719b678157a9f945d37aedc11560de4d90428312ad1bb35a7ff5d5f5ad2032554d953d8d2fb1257bdb05b1f83b512cb8cd1d30190529d42136f6743eb028c
SSDEEP

96:hy859x0P8Mag81rl+FMlYATFM1l3jckRbnw0kw9VcfHI9HttwC2O6/:F5oLcrlPCUcjwHw9efoJPx6/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3144	5088	rundll32.exe	56
PID 5088 wrote to memory of 3144	5088	rundll32.exe	56
PID 5088 wrote to memory of 3144	5088	rundll32.exe	56

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2cc018698fe084fce7aa53e8244c8a80.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2cc018698fe084fce7aa53e8244c8a80.dll,#1
  2⤵
  PID:3144