4efe2fca04fb7c1a99f1ce25599cfc74a6472b324c51dc80a841a2418589fd27

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 13:57

Target

NEAS.d6db744f2cd6b72e8aab9f2451f6ff70_JC.exe
Size

409KB
MD5

d6db744f2cd6b72e8aab9f2451f6ff70
SHA1

4210eead5745a55913093a448d357a85e0290081
SHA256

4efe2fca04fb7c1a99f1ce25599cfc74a6472b324c51dc80a841a2418589fd27
SHA512

6cbc9bdbc4a1863a6eaa7f2f5a3cb02f2e97d98b587f8c97f53336574abeea6ff9897561cdb1ccbb297f29891714d8ffe2c239e7c2c1afdb9949d9193a255129
SSDEEP

12288:GrWcDkpFBK4TuxD/pH7tyq3saa/D+oLecq:GrWcDkpm4Tc1btsbKoLecq

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2244	4AA7.tmp

Loads dropped DLL 1 IoCs

pid	Process
2064	NEAS.d6db744f2cd6b72e8aab9f2451f6ff70_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2244	2064	NEAS.d6db744f2cd6b72e8aab9f2451f6ff70_JC.exe	28
PID 2064 wrote to memory of 2244	2064	NEAS.d6db744f2cd6b72e8aab9f2451f6ff70_JC.exe	28
PID 2064 wrote to memory of 2244	2064	NEAS.d6db744f2cd6b72e8aab9f2451f6ff70_JC.exe	28
PID 2064 wrote to memory of 2244	2064	NEAS.d6db744f2cd6b72e8aab9f2451f6ff70_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.d6db744f2cd6b72e8aab9f2451f6ff70_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d6db744f2cd6b72e8aab9f2451f6ff70_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\4AA7.tmp
  "C:\Users\Admin\AppData\Local\Temp\4AA7.tmp" --pingC:\Users\Admin\AppData\Local\Temp\NEAS.d6db744f2cd6b72e8aab9f2451f6ff70_JC.exe 0E8249251A41A74C857FAECADF7D6FF71CEBC6290ABFA9E60460E04DD85102AAEDE38EA6A7EE0F6B5EEBA70D6DD9A39227BD58BD0E62582A8BFC932F8F2BF5F6
  2⤵
  - Executes dropped EXE
  PID:2244

C:\Users\Admin\AppData\Local\Temp\4AA7.tmp

Filesize
409KB

MD5
5535d78ea5e5a272f08411c8ad384f80

SHA1
464626f55e2f4ba12ea0a93138acb4890a5f081e

SHA256
d538190879186f28702792f6e0d652240a119588041dab91f285d1d8bc34b646

SHA512
2f60dcd9368c184910941c8439365b1c0c13d3dd75e114c5f2ee4d1bfc90d96b606d3138b55399ea55fa8b21fde7428226e3ef89aa9d00d34b2432824962f34f

Download Submit
\Users\Admin\AppData\Local\Temp\4AA7.tmp

Filesize
409KB

MD5
5535d78ea5e5a272f08411c8ad384f80

SHA1
464626f55e2f4ba12ea0a93138acb4890a5f081e

SHA256
d538190879186f28702792f6e0d652240a119588041dab91f285d1d8bc34b646

SHA512
2f60dcd9368c184910941c8439365b1c0c13d3dd75e114c5f2ee4d1bfc90d96b606d3138b55399ea55fa8b21fde7428226e3ef89aa9d00d34b2432824962f34f

Download Submit