a02770878f17460816dadc78837e96f59f6513fb8bbc27059b9ed114c8ece566

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 01:42 UTC

Target

48a49dd674ffd9312fe0b46d0d841710_NEAS.dll
Size

5KB
MD5

48a49dd674ffd9312fe0b46d0d841710
SHA1

797d06c50bd77953d865015031699a8217f40303
SHA256

a02770878f17460816dadc78837e96f59f6513fb8bbc27059b9ed114c8ece566
SHA512

79d3915a23d0cc7902992fc3cf96a140b495565e006271a853243e7189f5935ab983182485f22c5ca391a1c55cacaafcbb8908486fa95eb173a83df1c93d6cff
SSDEEP

96:nEY2RrF1eqwi402Px8xh+Kv1P7FSnC0KWNTY3b8H78fideA:EHRh1epp02PQP7FgCNWNC8O0T

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2192	2172	rundll32.exe	28
PID 2172 wrote to memory of 2192	2172	rundll32.exe	28
PID 2172 wrote to memory of 2192	2172	rundll32.exe	28
PID 2172 wrote to memory of 2192	2172	rundll32.exe	28
PID 2172 wrote to memory of 2192	2172	rundll32.exe	28
PID 2172 wrote to memory of 2192	2172	rundll32.exe	28
PID 2172 wrote to memory of 2192	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48a49dd674ffd9312fe0b46d0d841710_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48a49dd674ffd9312fe0b46d0d841710_NEAS.dll,#1
  2⤵
  PID:2192