a2361490d4899a7cd0d2f8ce4c5d68e3f363e10fdb3c7ff4e9e8063efd23b619

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 05:42

Target

NEAS.cdb6d2420f230471d9bcfdfcf409a710.dll
Size

728KB
MD5

cdb6d2420f230471d9bcfdfcf409a710
SHA1

10ba02902b9f2175a9d9dcb6d94685e6e6134ce7
SHA256

a2361490d4899a7cd0d2f8ce4c5d68e3f363e10fdb3c7ff4e9e8063efd23b619
SHA512

23256fc905bf1137a15148b5d088e1ce4584ead89a40476f6da2db64576b47941e20cc537ba6c47c9d2058bd13327e85f29826b694fbee8f7a81c229cbe5d6fc
SSDEEP

12288:smWHjxPmdXUDV8xAxxcbz1TZSwQmWhND9yJz+b1FcMLmp2ATTSsd:smajtmdkDV8xAxubz1TZdQmUNJyJqb1u

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	2572	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2572	2256	rundll32.exe	28
PID 2256 wrote to memory of 2572	2256	rundll32.exe	28
PID 2256 wrote to memory of 2572	2256	rundll32.exe	28
PID 2256 wrote to memory of 2572	2256	rundll32.exe	28
PID 2256 wrote to memory of 2572	2256	rundll32.exe	28
PID 2256 wrote to memory of 2572	2256	rundll32.exe	28
PID 2256 wrote to memory of 2572	2256	rundll32.exe	28
PID 2572 wrote to memory of 2916	2572	rundll32.exe	29
PID 2572 wrote to memory of 2916	2572	rundll32.exe	29
PID 2572 wrote to memory of 2916	2572	rundll32.exe	29
PID 2572 wrote to memory of 2916	2572	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cdb6d2420f230471d9bcfdfcf409a710.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cdb6d2420f230471d9bcfdfcf409a710.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 196
    3⤵
    - Program crash
    PID:2916