ab6392cfc103c179ec441aa76352000f2760577cf3ae5e4f64eae93dda03a575

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 16:25

Target

d8a9f3d77c4ccbd28c822a51289aac80_NEAS.dll
Size

6KB
MD5

d8a9f3d77c4ccbd28c822a51289aac80
SHA1

7a828e93b2b72c720cf776de3d5caf65dfd45ad1
SHA256

ab6392cfc103c179ec441aa76352000f2760577cf3ae5e4f64eae93dda03a575
SHA512

7d0cc0ba5a03b7d1e63d0d5e632d0de9de355f56601022b0322df471ad7d1a6c1349158be90e367d32ddd18ba2da3d56f0882d93dcd9d3f427f393851d4e5be9
SSDEEP

96:hy859x0P8MaMmiZFY0N7rB9BHe7tPh+/BdAb9uOdEm7cci:F5oLhjZFYK1HUi/Bdw9u

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28
PID 2340 wrote to memory of 2276	2340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8a9f3d77c4ccbd28c822a51289aac80_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8a9f3d77c4ccbd28c822a51289aac80_NEAS.dll,#1
  2⤵
  PID:2276