1d3207716ffe799768cb33c5b7ae2c656321b0167426365db481bd2ad01e3828

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05/11/2023, 09:54

Target

NEAS.2a612ba4fa36b44f31750157a0065420.dll
Size

736KB
MD5

2a612ba4fa36b44f31750157a0065420
SHA1

1036f9bdcfb2cea094354f5f444548e83bf3edc8
SHA256

1d3207716ffe799768cb33c5b7ae2c656321b0167426365db481bd2ad01e3828
SHA512

550b5191971d78d1661ccf6ac937085cd0877273579d8e6761d4ffe5b6d18d226122a97188f529a74e3e5af4636b0b69463629d79b4cdd8fdfd63b7fd8b9938a
SSDEEP

12288:HlQXHbjkbigibQM1wh0Azn/NtY0uTg9H6aGnZxqYj52qd+DZeo7tEoHT90bF+040:FQrjkbigiscATNtuTWaZx8qoDZBuz4Y5

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2060	2248	rundll32.exe	28
PID 2248 wrote to memory of 2060	2248	rundll32.exe	28
PID 2248 wrote to memory of 2060	2248	rundll32.exe	28
PID 2248 wrote to memory of 2060	2248	rundll32.exe	28
PID 2248 wrote to memory of 2060	2248	rundll32.exe	28
PID 2248 wrote to memory of 2060	2248	rundll32.exe	28
PID 2248 wrote to memory of 2060	2248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2a612ba4fa36b44f31750157a0065420.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2a612ba4fa36b44f31750157a0065420.dll,#1
  2⤵
  PID:2060

memory/2060-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2060-1-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2060-2-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2060-3-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download