ee57cd2e67a5e2e1b0b8a03b896506c2adc019d36181a0c94ce3f190d086d54c

Analysis

max time kernel
105s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2023, 21:33

Target

NEAS.d7cbdd3ed56aeb82e358b8b0e3b8eda0.exe
Size

45KB
MD5

d7cbdd3ed56aeb82e358b8b0e3b8eda0
SHA1

6089045f4f8166770fdd5e35e4440e0bc574f1ce
SHA256

ee57cd2e67a5e2e1b0b8a03b896506c2adc019d36181a0c94ce3f190d086d54c
SHA512

455160c7db82afd957a234ae753677535b60f9b10d3d59674bc6b010194c424c9a9431fe9479c6357b1419c89f3c48962cdf95a8776352ea7e0f3f1eab5a6a71
SSDEEP

768:Erz+1KIDKxztFE0jVvCTdzTMi8MFog/V7g7RRhjpy:EqKxs0gTzM0gnhjA

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4940	rmass.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\rmass.exe	NEAS.d7cbdd3ed56aeb82e358b8b0e3b8eda0.exe
File created	C:\WINDOWS\SysWOW64\rmass.exe	NEAS.d7cbdd3ed56aeb82e358b8b0e3b8eda0.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.d7cbdd3ed56aeb82e358b8b0e3b8eda0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d7cbdd3ed56aeb82e358b8b0e3b8eda0.exe"
1⤵
- Drops file in System32 directory
PID:1236
- C:\WINDOWS\SysWOW64\rmass.exe
  "C:\WINDOWS\system32\rmass.exe"
  2⤵
  - Executes dropped EXE
  PID:4940

C:\Windows\SysWOW64\rmass.exe

Filesize
42KB

MD5
00fddbe977261072415fbe38806894d2

SHA1
fd565e101fd6edbb59e4df8e6cd837c23ef80e4a

SHA256
4e9a967d7c6d855245f847e35978d9b30d70487aa06de649def297e7fd5a10c6

SHA512
d35dee588b55640642ef9f0ffb9dcb405cfb3f28b27bcd638d21181d619217a2ac345b145bc6145d2e492976263ba429161e0415260b88772a607024e916f94b

Download Submit
memory/1236-0-0x0000000077012000-0x0000000077013000-memory.dmp

Filesize
4KB

Download
memory/1236-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download