6be3273e3f430bc67e0d4aa7c08aa462b20b840284e204390836a9c0d6b7e9d2

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 12:26

Target

78ab82c6469b071408f2024130a18880_NEAS.dll
Size

81KB
MD5

78ab82c6469b071408f2024130a18880
SHA1

aa3c572c551eabc7b34e4d92e81589a8c24dc76b
SHA256

6be3273e3f430bc67e0d4aa7c08aa462b20b840284e204390836a9c0d6b7e9d2
SHA512

fed91890b9caf1d353587de6583206765e5e0dc192367a96d06d6a41bcc22b3785223731fa5f8a6c005276cdf39dab9adde4231101a05c1c7c0d826f395341d3
SSDEEP

1536:6ByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8Wb:bv4JKXTx71wnArSsXFpeXq8Wb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 2024	4188	rundll32.exe	91
PID 4188 wrote to memory of 2024	4188	rundll32.exe	91
PID 4188 wrote to memory of 2024	4188	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78ab82c6469b071408f2024130a18880_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78ab82c6469b071408f2024130a18880_NEAS.dll,#1
  2⤵
  PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:1388