d80bde83d0e238fac61d9b30d62da1e3d37ad9333a3f68381dcb1b026e21830b

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 12:04

Target

6c60eb13515e3167a9f17ce06c0eda60_NEAS.dll
Size

7KB
MD5

6c60eb13515e3167a9f17ce06c0eda60
SHA1

8e14bd5223cff5656bfc911a832fa5f4823f4bc3
SHA256

d80bde83d0e238fac61d9b30d62da1e3d37ad9333a3f68381dcb1b026e21830b
SHA512

44352b0c306e087a591e022fc67363f6c1259f622c59fc16cb3f960292bdb01075a582d1907b1ab6e81237945b54d3c5a842249f98475841ea8af84898f118a2
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIbqRuzXr4lVIoPUtMRw9JmT9nRHBtXQvt5x43S0j:unSR6bgYQhzXwIo5RwjY08j

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28
PID 2972 wrote to memory of 2708	2972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c60eb13515e3167a9f17ce06c0eda60_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c60eb13515e3167a9f17ce06c0eda60_NEAS.dll,#1
  2⤵
  PID:2708