d80bde83d0e238fac61d9b30d62da1e3d37ad9333a3f68381dcb1b026e21830b

Analysis

max time kernel
134s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 12:04

Target

6c60eb13515e3167a9f17ce06c0eda60_NEAS.dll
Size

7KB
MD5

6c60eb13515e3167a9f17ce06c0eda60
SHA1

8e14bd5223cff5656bfc911a832fa5f4823f4bc3
SHA256

d80bde83d0e238fac61d9b30d62da1e3d37ad9333a3f68381dcb1b026e21830b
SHA512

44352b0c306e087a591e022fc67363f6c1259f622c59fc16cb3f960292bdb01075a582d1907b1ab6e81237945b54d3c5a842249f98475841ea8af84898f118a2
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIbqRuzXr4lVIoPUtMRw9JmT9nRHBtXQvt5x43S0j:unSR6bgYQhzXwIo5RwjY08j

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5588 wrote to memory of 1248	5588	rundll32.exe	87
PID 5588 wrote to memory of 1248	5588	rundll32.exe	87
PID 5588 wrote to memory of 1248	5588	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c60eb13515e3167a9f17ce06c0eda60_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c60eb13515e3167a9f17ce06c0eda60_NEAS.dll,#1
  2⤵
  PID:1248