e41f91597489770b89ea30e2ca99e143be8962870112c6b722e461bcfc1b0178 | Triage

Analysis

max time kernel
90s
max time network
33s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 19:33

Sharing

Report Analysis Logs

General

Target

NEAS.ef71062a9b78a3ebdce4525f5a3e3230.dll
Size

5KB
MD5

ef71062a9b78a3ebdce4525f5a3e3230
SHA1

2697284d2cf40735137e27f8d4a27687ff5b1990
SHA256

e41f91597489770b89ea30e2ca99e143be8962870112c6b722e461bcfc1b0178
SHA512

1ec5790c4d0df0d5334edf7f3767fba2da51621fee9bb0ed68cb6d3d91fb30a9d99b04cbb64f8926b75ccbe5fcdd4018399b6b717c5f32f0a3bac7f35087b6de
SSDEEP

96:hy859x0P8MaF1qgxVUwZN98bH76DQuaV0jsT3GLQ6:F5oLc1F9KHGQuDWMQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2492	2712	rundll32.exe	29
PID 2712 wrote to memory of 2492	2712	rundll32.exe	29
PID 2712 wrote to memory of 2492	2712	rundll32.exe	29
PID 2712 wrote to memory of 2492	2712	rundll32.exe	29
PID 2712 wrote to memory of 2492	2712	rundll32.exe	29
PID 2712 wrote to memory of 2492	2712	rundll32.exe	29
PID 2712 wrote to memory of 2492	2712	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ef71062a9b78a3ebdce4525f5a3e3230.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ef71062a9b78a3ebdce4525f5a3e3230.dll,#1
  2⤵
  PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads