a59545daa2861a812baf808457f02fb170becea4e3c1110716071d030d25fbdc

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 10:20

Target

3d4316658edc26af63f3658977c6ed80_NEAS.dll
Size

5KB
MD5

3d4316658edc26af63f3658977c6ed80
SHA1

737343451a4cb66ad8fa41841d5892816201d6a0
SHA256

a59545daa2861a812baf808457f02fb170becea4e3c1110716071d030d25fbdc
SHA512

d587fb7d6526a271210aeeb0662ea98274a6ee93c1195863688a2a2838a4508d9fe172556a1e50b0cec861f477f9f127260cf9e06ee379b71f3cea3ea7c90914
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqTfjddncTpXDThl/o/8C+fS8gy2Jo2RFO6n:hy859x0P8MajzcTpzTX/nfo2ytdZgo

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28
PID 2008 wrote to memory of 1792	2008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d4316658edc26af63f3658977c6ed80_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d4316658edc26af63f3658977c6ed80_NEAS.dll,#1
  2⤵
  PID:1792