c421a740cd2e5bd3f418e48735b683cf6281360368aba5bfa7f4c7ddf368986a

Analysis

max time kernel
194s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:35

Target

NEAS.afea915e5f871b74cf88ae6f91f61540.exe
Size

373KB
MD5

afea915e5f871b74cf88ae6f91f61540
SHA1

c38d1d70df125a8a93ca5d0f2d138b16dd56218c
SHA256

c421a740cd2e5bd3f418e48735b683cf6281360368aba5bfa7f4c7ddf368986a
SHA512

aa984158a545d848f859889a99652300db59459d382b0991d8ae48bf651b5fb7fbca9f41301e89946d9fadd73b91ee7ceecea8291fd868a25c3a0256e7d0226c
SSDEEP

6144:sm5UsluzKOkwWcSxJVuftLM6DV/+oO02IYiiVg4Iw75diqOhAmJiv27g8x41C1:smqslOKHwSAtXKZeqORW27D4o

Score

4^/10

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\adobe\acrotray .exe	NEAS.afea915e5f871b74cf88ae6f91f61540.exe
File created	\??\c:\program files (x86)\adobe\acrotray.exe	NEAS.afea915e5f871b74cf88ae6f91f61540.exe
File created	\??\c:\program files (x86)\internet explorer\wmpscfgs.exe	NEAS.afea915e5f871b74cf88ae6f91f61540.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3372	4152	WerFault.exe	34
3464	4152	WerFault.exe	34

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4152	NEAS.afea915e5f871b74cf88ae6f91f61540.exe
4152	NEAS.afea915e5f871b74cf88ae6f91f61540.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4152	NEAS.afea915e5f871b74cf88ae6f91f61540.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 3372	4152	NEAS.afea915e5f871b74cf88ae6f91f61540.exe	90
PID 4152 wrote to memory of 3372	4152	NEAS.afea915e5f871b74cf88ae6f91f61540.exe	90
PID 4152 wrote to memory of 3372	4152	NEAS.afea915e5f871b74cf88ae6f91f61540.exe	90

C:\Users\Admin\AppData\Local\Temp\NEAS.afea915e5f871b74cf88ae6f91f61540.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.afea915e5f871b74cf88ae6f91f61540.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 660
  2⤵
  - Program crash
  PID:3372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 660
  2⤵
  - Program crash
  PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4152 -ip 4152
1⤵
PID:2288

memory/4152-0-0x0000000000400000-0x000000000042542C-memory.dmp

Filesize
149KB

Download
memory/4152-1-0x0000000000400000-0x000000000042542C-memory.dmp

Filesize
149KB

Download
memory/4152-2-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download