24290d8cea0f1f6c64303827f07e8e3c2e03cc7b60bbb3ce3cc66c074b6b2b18

Analysis

max time kernel
78s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:22

Target

NEAS.479ba7490e68866c717b4aee2ddfe0c0.exe
Size

24KB
MD5

479ba7490e68866c717b4aee2ddfe0c0
SHA1

9f851b99111d8e50066da18902454429436dda4c
SHA256

24290d8cea0f1f6c64303827f07e8e3c2e03cc7b60bbb3ce3cc66c074b6b2b18
SHA512

80b930b967267dde30f9a35471cefef7917bb26a72d2435338e3294ab33bc9dc47637e6bb40f6f3822be5b1c4d4d2b731ff64e3feddf44f991b0c3d51d7299ba
SSDEEP

384:hoIRlQgktqYekvLyqRsjPdPyQMs14kVdjaLacmkC0GJsJxXSdqWoZDEWA:hoMkZDzlswQMs1tjaLacmkLGKddm

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\systemInfomations.ini	NEAS.479ba7490e68866c717b4aee2ddfe0c0.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 2340	4912	NEAS.479ba7490e68866c717b4aee2ddfe0c0.exe	86
PID 4912 wrote to memory of 2340	4912	NEAS.479ba7490e68866c717b4aee2ddfe0c0.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.479ba7490e68866c717b4aee2ddfe0c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.479ba7490e68866c717b4aee2ddfe0c0.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Modifies registry class
  PID:2340