a4b0e49f1f558ef87d6d44cd00d359fa95dcc2011c8e0f5233006ab79ec78b00

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 17:57

Target

NEAS.65891e25f731165ae8b932ffcf782e50.exe
Size

95KB
MD5

65891e25f731165ae8b932ffcf782e50
SHA1

0fb04fdbcb6366822d7636b4c17a921e7550b4e3
SHA256

a4b0e49f1f558ef87d6d44cd00d359fa95dcc2011c8e0f5233006ab79ec78b00
SHA512

eb309fcd156af0f9476dc2810dbc065098c7852b2c2f1582f41e9ea1dc1f2f8f55a8a0276a3e2838546de21391190ffa7d94000f257c14e817fd4fb3109ad9e7
SSDEEP

1536:r6IY6l02vtKtBCyosa+G6FF0cB02RSpolKHZaLI3dgJlpCMsSx05ZFc:eR2FKvCyta+DC+Mpo0HZNwls5g

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3160 set thread context of 1804	3160	NEAS.65891e25f731165ae8b932ffcf782e50.exe	85

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3160	NEAS.65891e25f731165ae8b932ffcf782e50.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 1804	3160	NEAS.65891e25f731165ae8b932ffcf782e50.exe	85
PID 3160 wrote to memory of 1804	3160	NEAS.65891e25f731165ae8b932ffcf782e50.exe	85
PID 3160 wrote to memory of 1804	3160	NEAS.65891e25f731165ae8b932ffcf782e50.exe	85
PID 3160 wrote to memory of 1804	3160	NEAS.65891e25f731165ae8b932ffcf782e50.exe	85
PID 3160 wrote to memory of 1804	3160	NEAS.65891e25f731165ae8b932ffcf782e50.exe	85
PID 3160 wrote to memory of 1804	3160	NEAS.65891e25f731165ae8b932ffcf782e50.exe	85
PID 3160 wrote to memory of 1804	3160	NEAS.65891e25f731165ae8b932ffcf782e50.exe	85
PID 3160 wrote to memory of 1804	3160	NEAS.65891e25f731165ae8b932ffcf782e50.exe	85

C:\Users\Admin\AppData\Local\Temp\NEAS.65891e25f731165ae8b932ffcf782e50.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.65891e25f731165ae8b932ffcf782e50.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Users\Admin\AppData\Local\Temp\NEAS.65891e25f731165ae8b932ffcf782e50.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.65891e25f731165ae8b932ffcf782e50.exe
  2⤵
  PID:1804

memory/1804-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1804-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1804-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1804-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3160-0-0x0000000002370000-0x0000000002374000-memory.dmp

Filesize
16KB

Download