a2361490d4899a7cd0d2f8ce4c5d68e3f363e10fdb3c7ff4e9e8063efd23b619

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 05:42

Target

NEAS.cdb6d2420f230471d9bcfdfcf409a710.dll
Size

728KB
MD5

cdb6d2420f230471d9bcfdfcf409a710
SHA1

10ba02902b9f2175a9d9dcb6d94685e6e6134ce7
SHA256

a2361490d4899a7cd0d2f8ce4c5d68e3f363e10fdb3c7ff4e9e8063efd23b619
SHA512

23256fc905bf1137a15148b5d088e1ce4584ead89a40476f6da2db64576b47941e20cc537ba6c47c9d2058bd13327e85f29826b694fbee8f7a81c229cbe5d6fc
SSDEEP

12288:smWHjxPmdXUDV8xAxxcbz1TZSwQmWhND9yJz+b1FcMLmp2ATTSsd:smajtmdkDV8xAxubz1TZdQmUNJyJqb1u

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1392	4172	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 4172	1596	rundll32.exe	88
PID 1596 wrote to memory of 4172	1596	rundll32.exe	88
PID 1596 wrote to memory of 4172	1596	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cdb6d2420f230471d9bcfdfcf409a710.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.cdb6d2420f230471d9bcfdfcf409a710.dll,#1
  2⤵
  PID:4172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 560
    3⤵
    - Program crash
    PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4172 -ip 4172
1⤵
PID:4276