1d3207716ffe799768cb33c5b7ae2c656321b0167426365db481bd2ad01e3828

Analysis

max time kernel
98s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2023 09:54

Target

NEAS.2a612ba4fa36b44f31750157a0065420.dll
Size

736KB
MD5

2a612ba4fa36b44f31750157a0065420
SHA1

1036f9bdcfb2cea094354f5f444548e83bf3edc8
SHA256

1d3207716ffe799768cb33c5b7ae2c656321b0167426365db481bd2ad01e3828
SHA512

550b5191971d78d1661ccf6ac937085cd0877273579d8e6761d4ffe5b6d18d226122a97188f529a74e3e5af4636b0b69463629d79b4cdd8fdfd63b7fd8b9938a
SSDEEP

12288:HlQXHbjkbigibQM1wh0Azn/NtY0uTg9H6aGnZxqYj52qd+DZeo7tEoHT90bF+040:FQrjkbigiscATNtuTWaZx8qoDZBuz4Y5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 3248	3432	rundll32.exe	87
PID 3432 wrote to memory of 3248	3432	rundll32.exe	87
PID 3432 wrote to memory of 3248	3432	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2a612ba4fa36b44f31750157a0065420.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.2a612ba4fa36b44f31750157a0065420.dll,#1
  2⤵
  PID:3248

memory/3248-0-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download