d5eee47457f98313ada950974aa2a2cdf7b861dc8102efef45ea5ae33dd3c695 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
17/11/2023, 20:17

Sharing

Report Analysis Logs

General

Target

NEAS.ca9f272266730081c3b87eb7d11fc550.dll
Size

15KB
MD5

ca9f272266730081c3b87eb7d11fc550
SHA1

44f911a536d5c90697d98bc7f49b535d9ac57877
SHA256

d5eee47457f98313ada950974aa2a2cdf7b861dc8102efef45ea5ae33dd3c695
SHA512

3466501572f920849cee6632534f362ca0556acd28c785ce5f3bebb9d3833392a69f2a13c0c3005093032c7f1ae1544c1b89483e216d537fc6bc0d0833c3506b
SSDEEP

384:TT9iBhzhgGKH2sg0+3i043LCGXJLmPhpZTzC1:dcSbLCGXqZTzC1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2208	1188	rundll32.exe	28
PID 1188 wrote to memory of 2208	1188	rundll32.exe	28
PID 1188 wrote to memory of 2208	1188	rundll32.exe	28
PID 1188 wrote to memory of 2208	1188	rundll32.exe	28
PID 1188 wrote to memory of 2208	1188	rundll32.exe	28
PID 1188 wrote to memory of 2208	1188	rundll32.exe	28
PID 1188 wrote to memory of 2208	1188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ca9f272266730081c3b87eb7d11fc550.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.ca9f272266730081c3b87eb7d11fc550.dll,#1
  2⤵
  PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads