174700d6a90fa666845907b3a56db781d58a79e62428a50b876a5a38930f69cd

Analysis

max time kernel
138s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 15:43

Target

NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe
Size

276KB
MD5

043a588ea1fb3ef938126bd70c478990
SHA1

c4faaf47cbd068c67f329c3dd2421b13c16a046a
SHA256

174700d6a90fa666845907b3a56db781d58a79e62428a50b876a5a38930f69cd
SHA512

19e0573c5f55a8376af544e661bef95218bf8a74beb67efa3821327618a49b9b6d9ff1aca4393a37a438979572834dc87329fb460343e054a377f03a2d79b8f8
SSDEEP

6144:8hNnyaJ1GoQx90Bk6AFeSboIdb3FXNbJ+:8hlqoQ916keooOb3FXNo

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3156 set thread context of 2344	3156	NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe	43

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3156	NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 2344	3156	NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe	43
PID 3156 wrote to memory of 2344	3156	NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe	43
PID 3156 wrote to memory of 2344	3156	NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe	43
PID 3156 wrote to memory of 2344	3156	NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe	43
PID 3156 wrote to memory of 2344	3156	NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe	43
PID 3156 wrote to memory of 2344	3156	NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe	43
PID 3156 wrote to memory of 2344	3156	NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe	43
PID 3156 wrote to memory of 2344	3156	NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe	43

C:\Users\Admin\AppData\Local\Temp\NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Local\Temp\NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.043a588ea1fb3ef938126bd70c478990_JC.exe
  2⤵
  PID:2344

memory/2344-1-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2344-3-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2344-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2344-5-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3156-0-0x0000000002370000-0x0000000002374000-memory.dmp

Filesize
16KB

Download