29318f9b545c749f3514a2b375578dd0f6b45f620f586b1315491d8ddb25c76f

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11-11-2023 12:05

Target

NEAS.91b53260b6ade2e618b2fdcccb2062f0.dll
Size

264KB
MD5

91b53260b6ade2e618b2fdcccb2062f0
SHA1

c31b36facbfc5c271f99bef8cae0fa318214c3e0
SHA256

29318f9b545c749f3514a2b375578dd0f6b45f620f586b1315491d8ddb25c76f
SHA512

178bc54a029856fadbad37095894a451ff58ac00752a234fa09f9fcaf20c045dee201493d49c6defe506b0985df517a81c75b94c5a9b667532165c0513bb1c44
SSDEEP

3072:Xp+BAJm7E5V8WMzqQd4632gSJAYJIEblj7Vk3W+zBXX1sOK6U8:Z+BGm7quZzqQdL2gSNj7VKhsOK6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1792	2268	rundll32.exe	28
PID 2268 wrote to memory of 1792	2268	rundll32.exe	28
PID 2268 wrote to memory of 1792	2268	rundll32.exe	28
PID 2268 wrote to memory of 1792	2268	rundll32.exe	28
PID 2268 wrote to memory of 1792	2268	rundll32.exe	28
PID 2268 wrote to memory of 1792	2268	rundll32.exe	28
PID 2268 wrote to memory of 1792	2268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.91b53260b6ade2e618b2fdcccb2062f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.91b53260b6ade2e618b2fdcccb2062f0.dll,#1
  2⤵
  PID:1792

memory/1792-0-0x0000000000770000-0x00000000007B2000-memory.dmp

Filesize
264KB

Download