77dbc6aac385a696da7c85c9d41f0e89b4baa54b0b3c086f478df77b46006359

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:33

Target

NEAS.b1e85e73b6fc1754f882e6b586f78ca0.exe
Size

4.2MB
MD5

b1e85e73b6fc1754f882e6b586f78ca0
SHA1

4fe6207a03627d583d14254500d48a36561f2ff7
SHA256

77dbc6aac385a696da7c85c9d41f0e89b4baa54b0b3c086f478df77b46006359
SHA512

d5f74320c38be588b2ca622f390499737757cfd000987b67f9ee8d691251624a94deb985506fe12e8a1ed236af757a017cdc3d38bcedcf6118b412b613af93c5
SSDEEP

98304:/KeyRGebdCpy5atuKLXZYc6ePj+b4SrNEj5Jjk40EwMK42Z/F:SHYPy5alLXec6ePjX1Jn1q/F

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2332	uvw.exe

Loads dropped DLL 1 IoCs

pid	Process
2080	NEAS.b1e85e73b6fc1754f882e6b586f78ca0.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\mtohohck\uvw.exe	NEAS.b1e85e73b6fc1754f882e6b586f78ca0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2332	2080	NEAS.b1e85e73b6fc1754f882e6b586f78ca0.exe	28
PID 2080 wrote to memory of 2332	2080	NEAS.b1e85e73b6fc1754f882e6b586f78ca0.exe	28
PID 2080 wrote to memory of 2332	2080	NEAS.b1e85e73b6fc1754f882e6b586f78ca0.exe	28
PID 2080 wrote to memory of 2332	2080	NEAS.b1e85e73b6fc1754f882e6b586f78ca0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.b1e85e73b6fc1754f882e6b586f78ca0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b1e85e73b6fc1754f882e6b586f78ca0.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\mtohohck\uvw.exe
  "C:\Program Files (x86)\mtohohck\uvw.exe"
  2⤵
  - Executes dropped EXE
  PID:2332

C:\Program Files (x86)\mtohohck\uvw.exe

Filesize
4.2MB

MD5
15ae232cab36f2e38e1b8093d9b1f36a

SHA1
ff3d9d1101ca334a867c4746c68cb18eb294bdd1

SHA256
d5da2b0551c6474c0ca42c5458eb108ccef74231c3f2665aded4d83e46d6fda4

SHA512
c0faa435c8ad2fede6bd0338d2d6079b027004eb98e24ed726cb79df8af7ecaf673821cd0f570ca9b6e59bf9b8f0c8ef7e415e2f6f94343a6d342119bd4490cd

Download Submit
\Program Files (x86)\mtohohck\uvw.exe

Filesize
4.2MB

MD5
15ae232cab36f2e38e1b8093d9b1f36a

SHA1
ff3d9d1101ca334a867c4746c68cb18eb294bdd1

SHA256
d5da2b0551c6474c0ca42c5458eb108ccef74231c3f2665aded4d83e46d6fda4

SHA512
c0faa435c8ad2fede6bd0338d2d6079b027004eb98e24ed726cb79df8af7ecaf673821cd0f570ca9b6e59bf9b8f0c8ef7e415e2f6f94343a6d342119bd4490cd

Download Submit
memory/2080-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2080-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2080-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2332-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2332-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2332-10-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download