a59545daa2861a812baf808457f02fb170becea4e3c1110716071d030d25fbdc

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 10:20

Target

3d4316658edc26af63f3658977c6ed80_NEAS.dll
Size

5KB
MD5

3d4316658edc26af63f3658977c6ed80
SHA1

737343451a4cb66ad8fa41841d5892816201d6a0
SHA256

a59545daa2861a812baf808457f02fb170becea4e3c1110716071d030d25fbdc
SHA512

d587fb7d6526a271210aeeb0662ea98274a6ee93c1195863688a2a2838a4508d9fe172556a1e50b0cec861f477f9f127260cf9e06ee379b71f3cea3ea7c90914
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqTfjddncTpXDThl/o/8C+fS8gy2Jo2RFO6n:hy859x0P8MajzcTpzTX/nfo2ytdZgo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 4680	1048	rundll32.exe	85
PID 1048 wrote to memory of 4680	1048	rundll32.exe	85
PID 1048 wrote to memory of 4680	1048	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d4316658edc26af63f3658977c6ed80_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3d4316658edc26af63f3658977c6ed80_NEAS.dll,#1
  2⤵
  PID:4680