137d7cf39f8a6f104f12f91824a3850550744967f9c47224c8e624ecdb41c295

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 12:23

Target

777ac6ef46d63feb78b5d686a47edb30_NEAS.dll
Size

6KB
MD5

777ac6ef46d63feb78b5d686a47edb30
SHA1

4b6d4e27ee1f5fccc6b4f8363ae9bbe8aed28348
SHA256

137d7cf39f8a6f104f12f91824a3850550744967f9c47224c8e624ecdb41c295
SHA512

35928333e794e1b7c231b8dc353fdfc315f46d52ea82042c93e20d6f2ea904c2acc048e66ba93b55ce631b7a4797c0b943661f1242a3c8acda516f7f4c385402
SSDEEP

48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqYFCfKKFdIGK55vJO2d:hy859x0P8MaZfKKFdIGK55RO2d

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2188	2156	rundll32.exe	28
PID 2156 wrote to memory of 2188	2156	rundll32.exe	28
PID 2156 wrote to memory of 2188	2156	rundll32.exe	28
PID 2156 wrote to memory of 2188	2156	rundll32.exe	28
PID 2156 wrote to memory of 2188	2156	rundll32.exe	28
PID 2156 wrote to memory of 2188	2156	rundll32.exe	28
PID 2156 wrote to memory of 2188	2156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\777ac6ef46d63feb78b5d686a47edb30_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\777ac6ef46d63feb78b5d686a47edb30_NEAS.dll,#1
  2⤵
  PID:2188