2be20a36fc3ce761950e194bf344949a1f318330e8955289dfe8b0e3e659aa30

Analysis

max time kernel
130s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2023, 03:28

Target

NEAS.b31add4f22c5e7f112093b306a452a60.dll
Size

684KB
MD5

b31add4f22c5e7f112093b306a452a60
SHA1

6792a9d3ca7bcc14e4c87ef460af5f5248a88c84
SHA256

2be20a36fc3ce761950e194bf344949a1f318330e8955289dfe8b0e3e659aa30
SHA512

297559937a0d0ee099959445152a9cc5306f5a6360e6605dd47341801925716c0376b71ffbad5e57277416d47c7f1ce4f44d5d31c9249ab630cbbc47b5e22858
SSDEEP

12288:Go5QMWsf/vocEEI+OiVYt1ejTsDPRSec1SlmT7OvZ1bsof:Go3WW/vocEEI+OEa1JzRW1SlmTKhZsof

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	1428	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 1428	4756	rundll32.exe	87
PID 4756 wrote to memory of 1428	4756	rundll32.exe	87
PID 4756 wrote to memory of 1428	4756	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.b31add4f22c5e7f112093b306a452a60.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.b31add4f22c5e7f112093b306a452a60.dll,#1
  2⤵
  PID:1428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 544
    3⤵
    - Program crash
    PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1428 -ip 1428
1⤵
PID:548