a02770878f17460816dadc78837e96f59f6513fb8bbc27059b9ed114c8ece566

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 01:42

Target

48a49dd674ffd9312fe0b46d0d841710_NEAS.dll
Size

5KB
MD5

48a49dd674ffd9312fe0b46d0d841710
SHA1

797d06c50bd77953d865015031699a8217f40303
SHA256

a02770878f17460816dadc78837e96f59f6513fb8bbc27059b9ed114c8ece566
SHA512

79d3915a23d0cc7902992fc3cf96a140b495565e006271a853243e7189f5935ab983182485f22c5ca391a1c55cacaafcbb8908486fa95eb173a83df1c93d6cff
SSDEEP

96:nEY2RrF1eqwi402Px8xh+Kv1P7FSnC0KWNTY3b8H78fideA:EHRh1epp02PQP7FgCNWNC8O0T

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 944	876	rundll32.exe	84
PID 876 wrote to memory of 944	876	rundll32.exe	84
PID 876 wrote to memory of 944	876	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48a49dd674ffd9312fe0b46d0d841710_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48a49dd674ffd9312fe0b46d0d841710_NEAS.dll,#1
  2⤵
  PID:944