a261a0230b2bb7a40db7c5e0756089d7d1cc23f1e1cb9c5e633f9389d03b2ecc

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 08:28

Target

0ac8e7c6d51b39369b18024e5b2f6750_NEAS.dll
Size

5KB
MD5

0ac8e7c6d51b39369b18024e5b2f6750
SHA1

b8dde39f2f7b474e9ce6f87b44b894e89da7693d
SHA256

a261a0230b2bb7a40db7c5e0756089d7d1cc23f1e1cb9c5e633f9389d03b2ecc
SHA512

863fab3c84c40dcbe6c5c9d0d142183785f50f4032ac3042584c1e8302ab62bba572a19994ba0e8ad71bf507e6955413c7a81dea8e0233ea1e547b4ef2099666
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqPgcAN2GshjUhPZIk9hiASkd8wPAPbK0ce1:hy859x0P8MaPghlA8Fy6AzKEbO+re

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28
PID 2188 wrote to memory of 2004	2188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ac8e7c6d51b39369b18024e5b2f6750_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ac8e7c6d51b39369b18024e5b2f6750_NEAS.dll,#1
  2⤵
  PID:2004