e0e27d2046e2495f79c47c2ae07faa2fab7e3e43280adc1c171165ff4ac3ac81 | Triage

Analysis

max time kernel
118s
max time network
153s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05/11/2023, 19:23

Sharing

Report Analysis Logs

General

Target

NEAS.3ff53e67a2ff3d5aeb8e70c5651d2910.dll
Size

4KB
MD5

3ff53e67a2ff3d5aeb8e70c5651d2910
SHA1

4322c4e9e959a001518b5b3477e80ae869a7cd66
SHA256

e0e27d2046e2495f79c47c2ae07faa2fab7e3e43280adc1c171165ff4ac3ac81
SHA512

50b5a24c8b55a00bef3cf22501a4bdd1a32a3487facbf656b9513bd170eb801a3a1a6376178d87bf13153c946e0fa130292c952585ea12f648c2ebc4a6cb998f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2252	2680	rundll32.exe	29
PID 2680 wrote to memory of 2252	2680	rundll32.exe	29
PID 2680 wrote to memory of 2252	2680	rundll32.exe	29
PID 2680 wrote to memory of 2252	2680	rundll32.exe	29
PID 2680 wrote to memory of 2252	2680	rundll32.exe	29
PID 2680 wrote to memory of 2252	2680	rundll32.exe	29
PID 2680 wrote to memory of 2252	2680	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3ff53e67a2ff3d5aeb8e70c5651d2910.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.3ff53e67a2ff3d5aeb8e70c5651d2910.dll,#1
  2⤵
  PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads