897633938873dc0672621ea02ce432413929b1cafc0602e8db4f7b3c25f2b598

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 15:07

Target

c3af47cd33b6007091b5bc39142185b0_NEAS.dll
Size

5KB
MD5

c3af47cd33b6007091b5bc39142185b0
SHA1

6578cd2b2800c5e78fca314e85d105659847f778
SHA256

897633938873dc0672621ea02ce432413929b1cafc0602e8db4f7b3c25f2b598
SHA512

54ab8bad3f6e064622fcac668c7e42088124a040bf5b2a20523e4e3265e3058bd19367158630d217cd4fe4f3fbcfd319ded38d93ae92ac5f5cb2f572c4fe3453
SSDEEP

48:q0aaPO8jGSLIv+Tqq7NqrhWR07iIsitl6YtDytJFgOrnsB/SsyomXr6q1R8jn:1h9jTqMMrY0OI/KYyznSM+q1R8jn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2104	1948	rundll32.exe	28
PID 1948 wrote to memory of 2104	1948	rundll32.exe	28
PID 1948 wrote to memory of 2104	1948	rundll32.exe	28
PID 1948 wrote to memory of 2104	1948	rundll32.exe	28
PID 1948 wrote to memory of 2104	1948	rundll32.exe	28
PID 1948 wrote to memory of 2104	1948	rundll32.exe	28
PID 1948 wrote to memory of 2104	1948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3af47cd33b6007091b5bc39142185b0_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3af47cd33b6007091b5bc39142185b0_NEAS.dll,#1
  2⤵
  PID:2104