6d26c2e5c54d4788bc4f77aa07edf7b48410991e6dd14a330c6aef9918a52750

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 20:25

Target

NEAS.bfc583e04833619b83151ba11ebd5d50.dll
Size

5KB
MD5

bfc583e04833619b83151ba11ebd5d50
SHA1

4a8e9cfe76d7ae6b024c4c6042bf3efc4b93fa8c
SHA256

6d26c2e5c54d4788bc4f77aa07edf7b48410991e6dd14a330c6aef9918a52750
SHA512

57914f6e636bb405730bc0faefd3480a68cd165e95726cdecc8f1eaf00f43400c58203e3a030ee6439d94a626cb5331e779cc2c8ed77af7e4768e4696809c17b
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqOvt0ctrXzb03Me:hy859x0P8MaOF0ctrXzo3z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 4052	1216	rundll32.exe	70
PID 1216 wrote to memory of 4052	1216	rundll32.exe	70
PID 1216 wrote to memory of 4052	1216	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.bfc583e04833619b83151ba11ebd5d50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.bfc583e04833619b83151ba11ebd5d50.dll,#1
  2⤵
  PID:4052