b287f65978081097bd14145a5eedac7c29e8acc2d01da31510a949cb92506e50

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 06:09

Target

NEAS.59c2e846caec4a209a0062184f196760.dll
Size

171KB
MD5

59c2e846caec4a209a0062184f196760
SHA1

168a6d7748e7da44092d406f66e49afbe02df673
SHA256

b287f65978081097bd14145a5eedac7c29e8acc2d01da31510a949cb92506e50
SHA512

7ccd1e9e75e57011906620ca150471718a23857ae79907b08f55e7d29c4d9a56c7dca8b41e48cab84098834f70994c5083dec8b013bf61debcfcfbe0d273ee2d
SSDEEP

3072:Pwos+cCtn4HZMRRbS8FlUMpPYCmoHRihpopWI+XBJ44cP7:Pwj+cC45YY6TihpoY4J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3708	2900	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2900	2808	rundll32.exe	20
PID 2808 wrote to memory of 2900	2808	rundll32.exe	20
PID 2808 wrote to memory of 2900	2808	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.59c2e846caec4a209a0062184f196760.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.59c2e846caec4a209a0062184f196760.dll,#1
  2⤵
  PID:2900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 612
    3⤵
    - Program crash
    PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2900 -ip 2900
1⤵
PID:1560

memory/2900-0-0x0000000074FB0000-0x0000000074FE1000-memory.dmp

Filesize
196KB

Download
memory/2900-1-0x0000000074FB0000-0x0000000074FE1000-memory.dmp

Filesize
196KB

Download