ab6392cfc103c179ec441aa76352000f2760577cf3ae5e4f64eae93dda03a575

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 16:25

Target

d8a9f3d77c4ccbd28c822a51289aac80_NEAS.dll
Size

6KB
MD5

d8a9f3d77c4ccbd28c822a51289aac80
SHA1

7a828e93b2b72c720cf776de3d5caf65dfd45ad1
SHA256

ab6392cfc103c179ec441aa76352000f2760577cf3ae5e4f64eae93dda03a575
SHA512

7d0cc0ba5a03b7d1e63d0d5e632d0de9de355f56601022b0322df471ad7d1a6c1349158be90e367d32ddd18ba2da3d56f0882d93dcd9d3f427f393851d4e5be9
SSDEEP

96:hy859x0P8MaMmiZFY0N7rB9BHe7tPh+/BdAb9uOdEm7cci:F5oLhjZFYK1HUi/Bdw9u

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4236	4756	rundll32.exe	83
PID 4756 wrote to memory of 4236	4756	rundll32.exe	83
PID 4756 wrote to memory of 4236	4756	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8a9f3d77c4ccbd28c822a51289aac80_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d8a9f3d77c4ccbd28c822a51289aac80_NEAS.dll,#1
  2⤵
  PID:4236