41c179aff659bbc1bb8296fedeb888f436192ff12439c3176cb19795fbb23b7d

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 09:18

Target

1fb5ac962fff3f3ad395677edb2fdd90_NEAS.dll
Size

1.7MB
MD5

1fb5ac962fff3f3ad395677edb2fdd90
SHA1

dcac3f3d19c9c783e2aace00e8c1546b529f95eb
SHA256

41c179aff659bbc1bb8296fedeb888f436192ff12439c3176cb19795fbb23b7d
SHA512

991770f50d08358a36636b760cbc85a16a77027895f60bd73c6c6ae82ffdae5eac9d4780e320738cf3d163097d95f3e471dc2a44c5d73d2791cd96c604fe7b4e
SSDEEP

24576:9+wp56ecmB1idxN383NKAl4GptVctXRzVNiG34UB7pd8HFBiYk4JujwetFi8EbUb:dr6ecmB1idxN38wVNimPNp7tFi8nD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1728	2508	rundll32.exe	28
PID 2508 wrote to memory of 1728	2508	rundll32.exe	28
PID 2508 wrote to memory of 1728	2508	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1fb5ac962fff3f3ad395677edb2fdd90_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2508 -s 160
  2⤵
  PID:1728