a261a0230b2bb7a40db7c5e0756089d7d1cc23f1e1cb9c5e633f9389d03b2ecc

Analysis

max time kernel
132s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 08:28

Target

0ac8e7c6d51b39369b18024e5b2f6750_NEAS.dll
Size

5KB
MD5

0ac8e7c6d51b39369b18024e5b2f6750
SHA1

b8dde39f2f7b474e9ce6f87b44b894e89da7693d
SHA256

a261a0230b2bb7a40db7c5e0756089d7d1cc23f1e1cb9c5e633f9389d03b2ecc
SHA512

863fab3c84c40dcbe6c5c9d0d142183785f50f4032ac3042584c1e8302ab62bba572a19994ba0e8ad71bf507e6955413c7a81dea8e0233ea1e547b4ef2099666
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqPgcAN2GshjUhPZIk9hiASkd8wPAPbK0ce1:hy859x0P8MaPghlA8Fy6AzKEbO+re

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 1076	4080	rundll32.exe	83
PID 4080 wrote to memory of 1076	4080	rundll32.exe	83
PID 4080 wrote to memory of 1076	4080	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ac8e7c6d51b39369b18024e5b2f6750_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0ac8e7c6d51b39369b18024e5b2f6750_NEAS.dll,#1
  2⤵
  PID:1076