6cbe3127fe9d1a9c6d293676d825011cb3447c29651a79b357a9a1d5253bef5d | Triage

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 20:46

Sharing

Report Analysis Logs

General

Target

NEAS.da3bdecb18baafce033d3e7e30d1d300.dll
Size

6KB
MD5

da3bdecb18baafce033d3e7e30d1d300
SHA1

7b4f77fddca9bfcf32ab5dc325da54d57b5d18b7
SHA256

6cbe3127fe9d1a9c6d293676d825011cb3447c29651a79b357a9a1d5253bef5d
SHA512

5fd6279adce845dff8b67adcd73db64889b4054c8ba255754884e6941086e7fc6b243500e6f2b0a741dc0be259529f141862ec74880792186f4a0707dae53812
SSDEEP

96:hy859x0P8MapV/mf4+NPLPjrgp9XLAGJ9I:F5oL+mf4qPLPjUTLnJ9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2132	1224	rundll32.exe	44
PID 1224 wrote to memory of 2132	1224	rundll32.exe	44
PID 1224 wrote to memory of 2132	1224	rundll32.exe	44

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.da3bdecb18baafce033d3e7e30d1d300.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.da3bdecb18baafce033d3e7e30d1d300.dll,#1
  2⤵
  PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads