d3ca4b3e49624f799f2452de315439641479beaab65a7e65ba5275e889d1e23b | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/05/2024, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

33edd9ac7f20da7b7afbcc111f13de10_NEAS.dll
Size

3.7MB
MD5

33edd9ac7f20da7b7afbcc111f13de10
SHA1

57db4862ba2c2e6dfa8e1b0aac760f8c89509dc7
SHA256

d3ca4b3e49624f799f2452de315439641479beaab65a7e65ba5275e889d1e23b
SHA512

8d49dcb3d01a7e349e1dc06c50c4cdf92bdd9a08f25fcf3d8505ebef2f20db45d9c07ba509e06b4848f8a218e1f4776994e159ee498778e2eaf74a09a98e50dd
SSDEEP

98304:Iaa9ciIQge980cKl4wFSvvCp23xFjg60dM:ta9RlHSx3xFjgm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1468	1472	rundll32.exe	28
PID 1472 wrote to memory of 1468	1472	rundll32.exe	28
PID 1472 wrote to memory of 1468	1472	rundll32.exe	28
PID 1472 wrote to memory of 1468	1472	rundll32.exe	28
PID 1472 wrote to memory of 1468	1472	rundll32.exe	28
PID 1472 wrote to memory of 1468	1472	rundll32.exe	28
PID 1472 wrote to memory of 1468	1472	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33edd9ac7f20da7b7afbcc111f13de10_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33edd9ac7f20da7b7afbcc111f13de10_NEAS.dll,#1
  2⤵
  PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads