f985b126047f6c1a99128aa714a55e310ed663ba732b1ba586b31badf58b4a8f

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 18:41

Target

00bcf2f535ca72cbb3e1ba82671238a0_NEAS.dll
Size

6KB
MD5

00bcf2f535ca72cbb3e1ba82671238a0
SHA1

321f1d870504299b7550881d2a2e7bb8f62c5fff
SHA256

f985b126047f6c1a99128aa714a55e310ed663ba732b1ba586b31badf58b4a8f
SHA512

89fbf07a26bb4d2495aa768ec1a8660f9bebea9da155e3554d7d2d55708ddf268f4ee019e82e7bd055d1c0886dee7341cdfe06ba9dc2cb55fa839ce778aaa994
SSDEEP

24:e1GSsABvVCecOeWNug/sPV6RVtU44MlWcUSwmNKlYY7pukf8lG5VxTvxzLc:SsGp63gAST0cMLlD7prUlG9Nzg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2268	1600	rundll32.exe	28
PID 1600 wrote to memory of 2268	1600	rundll32.exe	28
PID 1600 wrote to memory of 2268	1600	rundll32.exe	28
PID 1600 wrote to memory of 2268	1600	rundll32.exe	28
PID 1600 wrote to memory of 2268	1600	rundll32.exe	28
PID 1600 wrote to memory of 2268	1600	rundll32.exe	28
PID 1600 wrote to memory of 2268	1600	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\00bcf2f535ca72cbb3e1ba82671238a0_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00bcf2f535ca72cbb3e1ba82671238a0_NEAS.dll,#1
  2⤵
  PID:2268