1cf6e026900702a40705c2a88e1692888e41bd0e9d04359275f0d292f743d2d7 | Triage

Analysis

max time kernel
120s
max time network
152s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 20:28

Sharing

Report Analysis Logs

General

Target

NEAS.78c629c900e962fa061d7ba22935bb60.exe
Size

5KB
MD5

78c629c900e962fa061d7ba22935bb60
SHA1

4d298f0b12ee0287e71b2d2c5780b461a5a6f0e3
SHA256

1cf6e026900702a40705c2a88e1692888e41bd0e9d04359275f0d292f743d2d7
SHA512

be81baa5a015f0bebe11383d21eaf58534bff7653128678fc8eca2299b47f7e8ea141970ad37846ccdc598e4e0d78e9a70fd15100c2df1e55f4f41d6275e5ee9
SSDEEP

96:5ptHlXIsPFDHm/lMuNPdOJTrX2iegeUorz:5DlXPHmdTldOh2iegeUor

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2504	2808	NEAS.78c629c900e962fa061d7ba22935bb60.exe	32
PID 2808 wrote to memory of 2504	2808	NEAS.78c629c900e962fa061d7ba22935bb60.exe	32
PID 2808 wrote to memory of 2504	2808	NEAS.78c629c900e962fa061d7ba22935bb60.exe	32

C:\Users\Admin\AppData\Local\Temp\NEAS.78c629c900e962fa061d7ba22935bb60.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.78c629c900e962fa061d7ba22935bb60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\20231014T003932_031.exe
  2⤵
  PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads