a1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9

General

Target

NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe
Size

1.1MB
MD5

d9a1db6c9659aef95a8756b22b4f6afd
SHA1

bbeb38d3bd70e49fa550a3d9559fe27e9f1b500b
SHA256

a1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9
SHA512

45f04f2e6626f4a70df320487eda6c60f6d40db88b4072bfb1438f44e4e211eeb6ab4566ddd9ce9bd213ac58af84f8cb24a136ee267ca0a2e79f8d37e570c46d
SSDEEP

12288:MiWqqYfKnIakIMi6vpCsPaeG/fZ/sebGSGucaunoM9AR/Y68nf96KHVfh4NfgUvg:YYfKnIakIMiooTZsebLcB9ARl6VfeJC

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1100 set thread context of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2136	1100	WerFault.exe	27
2372	2428	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2428	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	29
PID 1100 wrote to memory of 2136	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	30
PID 1100 wrote to memory of 2136	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	30
PID 1100 wrote to memory of 2136	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	30
PID 1100 wrote to memory of 2136	1100	NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe	30
PID 2428 wrote to memory of 2372	2428	AppLaunch.exe	31
PID 2428 wrote to memory of 2372	2428	AppLaunch.exe	31
PID 2428 wrote to memory of 2372	2428	AppLaunch.exe	31
PID 2428 wrote to memory of 2372	2428	AppLaunch.exe	31
PID 2428 wrote to memory of 2372	2428	AppLaunch.exe	31
PID 2428 wrote to memory of 2372	2428	AppLaunch.exe	31
PID 2428 wrote to memory of 2372	2428	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEASa1321694c39b2f298172a3f4d6fca13479ab3241b760a2c818e067424abff8e9exeexeexe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 196
    3⤵
    - Program crash
    PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 52
  2⤵
  - Program crash
  PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2428-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2428-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2428-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2428-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2428-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2428-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2428-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2428-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2428-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads