605f33d96a1b2b6b4ad5271eda067819e147ffd47c09eedf0d9865fb7e9b1883 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:18

Sharing

Report Analysis Logs

General

Target

NEAS.426cac9999a8827aff3401c8ef9ba1e0.exe
Size

5KB
MD5

426cac9999a8827aff3401c8ef9ba1e0
SHA1

fccdc7c63ecd39657fc689076cfb640890cfe494
SHA256

605f33d96a1b2b6b4ad5271eda067819e147ffd47c09eedf0d9865fb7e9b1883
SHA512

99b4836c47747a6d73d88c84f801772441f0f28f5a07792ab3eeabc9eab8fd0a20ed1787e4a1a4f85f1bc877d32682788effe6f0e35efec6b755b75887079da0
SSDEEP

96:FRtHdXgT4VvLcwVkuuOS99oTrVu4fvor:F7dXQ4hLckuOS99Oor

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2412	2172	NEAS.426cac9999a8827aff3401c8ef9ba1e0.exe	29
PID 2172 wrote to memory of 2412	2172	NEAS.426cac9999a8827aff3401c8ef9ba1e0.exe	29
PID 2172 wrote to memory of 2412	2172	NEAS.426cac9999a8827aff3401c8ef9ba1e0.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.426cac9999a8827aff3401c8ef9ba1e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.426cac9999a8827aff3401c8ef9ba1e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\20231016T200303_770.exe
  2⤵
  PID:2412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads