7d1ae134102df159dcc2c1be5ef6e20600975e5c147f95b98ed4381ad3762ad6

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 14:46

Target

bda97af42fb0ef15977516df29d4ddb0_NEAS.dll
Size

81KB
MD5

bda97af42fb0ef15977516df29d4ddb0
SHA1

ecc988765af6a3627840b1b1c14271b0f8cd3665
SHA256

7d1ae134102df159dcc2c1be5ef6e20600975e5c147f95b98ed4381ad3762ad6
SHA512

67bba6469f2b4bc503ad740ee23ff25c974128896b601b95b54651c2265eb451eb006be204da6ed88566eb61d583926c8a134c4e6afa8c4670e9710c3f0fe896
SSDEEP

1536:uByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8W7:Pv4JKXTx71wnArSsXFpeXq8W7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 996	1204	rundll32.exe	83
PID 1204 wrote to memory of 996	1204	rundll32.exe	83
PID 1204 wrote to memory of 996	1204	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bda97af42fb0ef15977516df29d4ddb0_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bda97af42fb0ef15977516df29d4ddb0_NEAS.dll,#1
  2⤵
  PID:996