5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecde

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-10-2023 18:06

Target

NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe
Size

367KB
MD5

a61754746b52b33f7535dbf287e27276
SHA1

9525f35d9e894349f4ecbade7905752aaec0cc8d
SHA256

5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecde
SHA512

814e3d110abe6a0faf1bc4c025c7b3876abffc6f64ba2b5bf510d4c9fab3c138181069dd7673bd7a4603f66a7fca8e61ccccc0279ec3debdb3ab0452ff0c997d
SSDEEP

6144:RckOazRkzyPtvhW+m9VgbiNFeYOtYYE2Odtyqd72fOsA:WkOaz/Ptk+GVgwZlYrOiqoo

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe

description	pid	process	target process
PID 1816 wrote to memory of 1292	1816	NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe	NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe
PID 1816 wrote to memory of 1292	1816	NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe	NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe
PID 1816 wrote to memory of 1292	1816	NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe	NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe
PID 1816 wrote to memory of 1292	1816	NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe	NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816

C:\Users\Admin\AppData\Local\Temp\NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe
C:\Users\Admin\AppData\Local\Temp\NEAS.5af368f158382f62f886bc08d7eddc7c3b947ef6658535a05c5cab24e50cecdeexe_JC.exe
2⤵
PID:1292

memory/1816-0-0x0000000074920000-0x000000007500E000-memory.dmp

Filesize
6.9MB

Download
memory/1816-1-0x0000000001130000-0x0000000001190000-memory.dmp

Filesize
384KB

Download
memory/1816-2-0x0000000000590000-0x00000000005E4000-memory.dmp

Filesize
336KB

Download
memory/1816-3-0x0000000000D30000-0x0000000000D70000-memory.dmp

Filesize
256KB

Download
memory/1816-4-0x0000000000230000-0x000000000023A000-memory.dmp

Filesize
40KB

Download
memory/1816-5-0x0000000074920000-0x000000007500E000-memory.dmp

Filesize
6.9MB

Download