8b5790384d87e990a7da3eee2f2d56a9a70b42d6f9688bc4a25930ee8522ee26 | Triage

Analysis

max time kernel
83s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2023, 01:58

Sharing

Report Analysis Logs

General

Target

NEAS.0158ae5b1dc0e03a1f7716ff94f8f7f0.dll
Size

4KB
MD5

0158ae5b1dc0e03a1f7716ff94f8f7f0
SHA1

635314d31a13e8f7a0c2dfe79effd34d704ba04b
SHA256

8b5790384d87e990a7da3eee2f2d56a9a70b42d6f9688bc4a25930ee8522ee26
SHA512

337fe5f986c0f26fbcd5ce27874387087c08b60e3bdc90709e590b2c01bea9e55ec478371d9bd9ca212f8920720f8181ece501cc072235e58e36b20579d55717

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 336	564	rundll32.exe	88
PID 564 wrote to memory of 336	564	rundll32.exe	88
PID 564 wrote to memory of 336	564	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0158ae5b1dc0e03a1f7716ff94f8f7f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.0158ae5b1dc0e03a1f7716ff94f8f7f0.dll,#1
  2⤵
  PID:336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads