7d1ae134102df159dcc2c1be5ef6e20600975e5c147f95b98ed4381ad3762ad6

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 14:46

Target

bda97af42fb0ef15977516df29d4ddb0_NEAS.dll
Size

81KB
MD5

bda97af42fb0ef15977516df29d4ddb0
SHA1

ecc988765af6a3627840b1b1c14271b0f8cd3665
SHA256

7d1ae134102df159dcc2c1be5ef6e20600975e5c147f95b98ed4381ad3762ad6
SHA512

67bba6469f2b4bc503ad740ee23ff25c974128896b601b95b54651c2265eb451eb006be204da6ed88566eb61d583926c8a134c4e6afa8c4670e9710c3f0fe896
SSDEEP

1536:uByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8W7:Pv4JKXTx71wnArSsXFpeXq8W7

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2100	2872	rundll32.exe	28
PID 2872 wrote to memory of 2100	2872	rundll32.exe	28
PID 2872 wrote to memory of 2100	2872	rundll32.exe	28
PID 2872 wrote to memory of 2100	2872	rundll32.exe	28
PID 2872 wrote to memory of 2100	2872	rundll32.exe	28
PID 2872 wrote to memory of 2100	2872	rundll32.exe	28
PID 2872 wrote to memory of 2100	2872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bda97af42fb0ef15977516df29d4ddb0_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bda97af42fb0ef15977516df29d4ddb0_NEAS.dll,#1
  2⤵
  PID:2100