52e0062b36e5f2069a877468239f0a67adb80460118e11f5224de7f02d22f153

Analysis

max time kernel
115s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 22:04

Target

NEAS.f35a6ba4a72d7155c861579c80da5a40.dll
Size

2.1MB
MD5

f35a6ba4a72d7155c861579c80da5a40
SHA1

f579dcfaef6ce96325b12944a7bfd4cfdc2fa7c2
SHA256

52e0062b36e5f2069a877468239f0a67adb80460118e11f5224de7f02d22f153
SHA512

a3ca3f362aa2d613b169bb2be192b3970f20c4d8798fa3a021c45f35936c006d0307f6bf0823f5585ee69958fa7f81b5cdecfacb9a46bfc38a750769204684ab
SSDEEP

49152:y8feI79oK2xArHv31PQbhJ/P0BDpinATs75a78tW:y8D7WK2A/tHBDpgh08tW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4616	1772	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 1772	4756	rundll32.exe	84
PID 4756 wrote to memory of 1772	4756	rundll32.exe	84
PID 4756 wrote to memory of 1772	4756	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.f35a6ba4a72d7155c861579c80da5a40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.f35a6ba4a72d7155c861579c80da5a40.dll,#1
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 560
    3⤵
    - Program crash
    PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1772 -ip 1772
1⤵
PID:5044