d2ee5f795a6bb8a3ce37c54780d37429b69912633f6fbd3cd27df273718745bd

Analysis

max time kernel
165s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 12:57

Target

NEAS.124be3760c8a6a2f8ac4824fb5fa58e0_JC.exe
Size

200KB
MD5

124be3760c8a6a2f8ac4824fb5fa58e0
SHA1

0e3c4abadacc0a771f65992cb26d9b58c092eeda
SHA256

d2ee5f795a6bb8a3ce37c54780d37429b69912633f6fbd3cd27df273718745bd
SHA512

c911d204eeda2ab3a6c1858127fc194388e00c340f47963e2434a3454a02578a1fadcfda69e2d368c0fb6dca64768897450cc6cf7f5f87704c8efea300d21a1a
SSDEEP

6144:ld+hja/s1oWJ0uezK4WmlYW9IArXG1B7u:l0BesCWJYKTDjALG1BC

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2876	NEAS.124be3760c8a6a2f8ac4824fb5fa58e0_JC.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	2876	WerFault.exe	93

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4984	NEAS.124be3760c8a6a2f8ac4824fb5fa58e0_JC.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2876	NEAS.124be3760c8a6a2f8ac4824fb5fa58e0_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2876	4984	NEAS.124be3760c8a6a2f8ac4824fb5fa58e0_JC.exe	93
PID 4984 wrote to memory of 2876	4984	NEAS.124be3760c8a6a2f8ac4824fb5fa58e0_JC.exe	93
PID 4984 wrote to memory of 2876	4984	NEAS.124be3760c8a6a2f8ac4824fb5fa58e0_JC.exe	93

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4984 -ip 4984
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2876 -ip 2876
1⤵
PID:4624

C:\Users\Admin\AppData\Local\Temp\NEAS.124be3760c8a6a2f8ac4824fb5fa58e0_JC.exe

Filesize
200KB

MD5
d3ad266fd0976dbf0e313e5e12eec2c7

SHA1
0e4c3ef7edf463bd34e0f66e6d5adada23cbb938

SHA256
0c33b11ee71cb3e77879a48561012d6c5602ddaa535f631de23280db1134a6b4

SHA512
b9a70e85c204ca9b6e49f58c136e2aeb4dc10b59f747bf94e3b671017923f714cde4cc2b1c1dd4f2477fc6e0030986a8f8ab3172d6058275bcfcdbce7f1dc49e

Download Submit
memory/2876-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2876-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2876-9-0x0000000005DB0000-0x0000000005DEF000-memory.dmp

Filesize
252KB

Download
memory/2876-14-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4984-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4984-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download