34b728f6d923581dfd1fa0c2f073add6a8021731f302147c0c0c202242708b14

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 12:40

Target

8258ab8a7838b12e6e890688a7d9bbb0_NEAS.dll
Size

5KB
MD5

8258ab8a7838b12e6e890688a7d9bbb0
SHA1

62ff2eb2147f730f67b8c60e2d8158ff995fc7c2
SHA256

34b728f6d923581dfd1fa0c2f073add6a8021731f302147c0c0c202242708b14
SHA512

8497b36299708aa9662ef9df524ff7d0e2f45646a1cd13527b864f6ad53c35e73c251e2793f6affff12112e627de2d1951017102586e64f75bd24cb459aafa58
SSDEEP

48:C6VonAHso6U7lYa92RrpjwDmetlG95hx+iMHhz9eDjgy2wy5m1zjLdz2+4s3oFAu:nEY2RrF1eqwi4FQjgrm1zIs4+Td4Ij

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 292	2320	rundll32.exe	28
PID 2320 wrote to memory of 292	2320	rundll32.exe	28
PID 2320 wrote to memory of 292	2320	rundll32.exe	28
PID 2320 wrote to memory of 292	2320	rundll32.exe	28
PID 2320 wrote to memory of 292	2320	rundll32.exe	28
PID 2320 wrote to memory of 292	2320	rundll32.exe	28
PID 2320 wrote to memory of 292	2320	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8258ab8a7838b12e6e890688a7d9bbb0_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8258ab8a7838b12e6e890688a7d9bbb0_NEAS.dll,#1
  2⤵
  PID:292