4a61e8f3b9bced66b60c42a51ad751014006495ed65de18cf4b5543798bab40e | Triage

Analysis

max time kernel
12s
max time network
33s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 17:53

Sharing

Report Analysis Logs

General

Target

NEAS.48477299082a8b99c24bda87dfe67110.exe
Size

5KB
MD5

48477299082a8b99c24bda87dfe67110
SHA1

6f268d0e74c2b73c3fb9bf54558bf64d1499d900
SHA256

4a61e8f3b9bced66b60c42a51ad751014006495ed65de18cf4b5543798bab40e
SHA512

f87e035450fb665140567c0a0043e62c32b633749a8eb9055f9fce310e9b566e6724243b08983321deecdd668315de230fce652643833e99c41a25b657ba76d4
SSDEEP

96:zdtHwXPIJ4lvRwVoJWTOMTraFw4n2nOor:z/wXDxRNJWTOxor

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2804	1740	NEAS.48477299082a8b99c24bda87dfe67110.exe	29
PID 1740 wrote to memory of 2804	1740	NEAS.48477299082a8b99c24bda87dfe67110.exe	29
PID 1740 wrote to memory of 2804	1740	NEAS.48477299082a8b99c24bda87dfe67110.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.48477299082a8b99c24bda87dfe67110.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.48477299082a8b99c24bda87dfe67110.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\20231015T030229_911.exe
  2⤵
  PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads