98cd89574c41cd0f664b482c7964386b96987b8dac316860f4f02b351da8a77e

Analysis

max time kernel
136s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2023 16:50

Target

NEAS.98cd89574c41cd0f664b482c7964386b96987b8dac316860f4f02b351da8a77e.dll
Size

180KB
MD5

67b6b48ff9d6b2a39c2a9afbbadb6e31
SHA1

8430d9d0f97722bbd1af3ceb6271a2b1b6b8632a
SHA256

98cd89574c41cd0f664b482c7964386b96987b8dac316860f4f02b351da8a77e
SHA512

79bc21539fb4c92608def33768b2ddffb8cdb8b2ac5899a0d723233f0e4007c27403358872ca55843592b29a0d36b01b60ae53babefa14aec500643761cb1e95
SSDEEP

3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlL0bVaKoXAxOPYe:I74elpowsxizqyStZlpel5IyAxOPF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
744	3560	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 3560	112	rundll32.exe	86
PID 112 wrote to memory of 3560	112	rundll32.exe	86
PID 112 wrote to memory of 3560	112	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.98cd89574c41cd0f664b482c7964386b96987b8dac316860f4f02b351da8a77e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.98cd89574c41cd0f664b482c7964386b96987b8dac316860f4f02b351da8a77e.dll,#1
  2⤵
  PID:3560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 544
    3⤵
    - Program crash
    PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3560 -ip 3560
1⤵
PID:1652