d1eadb0f53b2c6950f4377321560e9d3853b1796d1dcfd7f5e132143d53de67f

Analysis

max time kernel
5s
max time network
3s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 17:20

Target

NEAS.65b63b818157265abb5d6b2a6c671030.exe
Size

9.1MB
MD5

65b63b818157265abb5d6b2a6c671030
SHA1

9bab3a77c6afc460513fa42d5decab9daf4c8ae9
SHA256

d1eadb0f53b2c6950f4377321560e9d3853b1796d1dcfd7f5e132143d53de67f
SHA512

9810e3aa71608cebf49304e225542b32caacea7c6d906436d7abba1995d7bb1ab8d390e5b41a81a6d39a94cc003eb27c36291b0d511297b78d666ebed6ac7a7c
SSDEEP

196608:UbFb3bPk5HyC8k5h/wDdEoNiV4I/WWwA7mdoNkBLOrrDfgZeVmCJWly:UbFb3bPk5HPhJCdBBB8Y7y

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1100-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\ehome\ehrecvr.exe	NEAS.65b63b818157265abb5d6b2a6c671030.exe
File created	C:\Windows\ehome\ehprivjob.exe	NEAS.65b63b818157265abb5d6b2a6c671030.exe
File created	C:\Windows\ehome\ehrec.exe	NEAS.65b63b818157265abb5d6b2a6c671030.exe
File created	C:\Windows\ehome\ehvid.exe	NEAS.65b63b818157265abb5d6b2a6c671030.exe
File created	C:\Windows\ehome\loadmxf.exe	NEAS.65b63b818157265abb5d6b2a6c671030.exe
File created	C:\Windows\Boot\PCAT\memtest.exe	NEAS.65b63b818157265abb5d6b2a6c671030.exe
File created	C:\Windows\ehome\ehexthost.exe	NEAS.65b63b818157265abb5d6b2a6c671030.exe
File created	C:\Windows\ehome\ehshell.exe	NEAS.65b63b818157265abb5d6b2a6c671030.exe
File created	C:\Windows\ehome\ehtray.exe	NEAS.65b63b818157265abb5d6b2a6c671030.exe
File created	C:\Windows\bfsvc.exe	NEAS.65b63b818157265abb5d6b2a6c671030.exe
File created	C:\Windows\ehome\ehsched.exe	NEAS.65b63b818157265abb5d6b2a6c671030.exe
File created	C:\Windows\ehome\CreateDisc\SBEServer.exe	NEAS.65b63b818157265abb5d6b2a6c671030.exe
File created	C:\Windows\ehome\ehmsas.exe	NEAS.65b63b818157265abb5d6b2a6c671030.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.65b63b818157265abb5d6b2a6c671030.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.65b63b818157265abb5d6b2a6c671030.exe"
1⤵
- Drops file in Windows directory
PID:1100

memory/1100-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download