97a8036d36fe4fc4022289c1964dce99e9feef4257f72c535a4cee4dc09f06e6

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2023 08:11

Target

NEAS.830a2bb590f2f0eb4b8a18d8eae9ad50.dll
Size

171KB
MD5

830a2bb590f2f0eb4b8a18d8eae9ad50
SHA1

b24175d00ec8b74ff75a8f1e82c76663d3fb01a1
SHA256

97a8036d36fe4fc4022289c1964dce99e9feef4257f72c535a4cee4dc09f06e6
SHA512

03d897bf2d408df8cb8f67584b56005cd0879b9cbfe1de00c9734d8aacda6146f1e35bb1af6989ea0623432d71f8faadd61db05982efb23b720f9effc13b1aef
SSDEEP

3072:V0KK+cCtn4HAYRbSIDyNNpaYCmo++ihpWOpIwXBJMNcf7Eol:V0T+cC4zEvMihpW2MwE+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4140	464	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 464	768	rundll32.exe	82
PID 768 wrote to memory of 464	768	rundll32.exe	82
PID 768 wrote to memory of 464	768	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.830a2bb590f2f0eb4b8a18d8eae9ad50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.830a2bb590f2f0eb4b8a18d8eae9ad50.dll,#1
  2⤵
  PID:464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 608
    3⤵
    - Program crash
    PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 464 -ip 464
1⤵
PID:5064

memory/464-0-0x0000000075800000-0x0000000075831000-memory.dmp

Filesize
196KB

Download
memory/464-1-0x0000000075800000-0x0000000075831000-memory.dmp

Filesize
196KB

Download