16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23-10-2023 16:24

Target

NEAS.16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738exe_JC.exe
Size

366KB
MD5

3c1ade1441ef11aed8496b742eab197b
SHA1

06ebde82c367791c03196888fb2fcc7721296564
SHA256

16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738
SHA512

79f35c1f552040fd3f5273aa288bbcc86662a325dc9fd5c1817d127568a5edd3337c9b124583c3e09d07c446dcdc2b6b515227ec0d987b6b8444f342046715a6
SSDEEP

6144:L0nJBIKD2SJMz2dR8rZNlvzGSTo5xBB9VVh8YZWUBwDPlj3y4QTdk6ceh9X3P92D:sJfD2S+nRqx39Xh88VBIlzy4Qpk6ceXx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

NEAS.16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738exe_JC.exe

description	pid	process	target process
PID 2516 wrote to memory of 2980	2516	NEAS.16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738exe_JC.exe	RegAsm.exe
PID 2516 wrote to memory of 2980	2516	NEAS.16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738exe_JC.exe	RegAsm.exe
PID 2516 wrote to memory of 2980	2516	NEAS.16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738exe_JC.exe	RegAsm.exe
PID 2516 wrote to memory of 2980	2516	NEAS.16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738exe_JC.exe	RegAsm.exe
PID 2516 wrote to memory of 2980	2516	NEAS.16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738exe_JC.exe	RegAsm.exe
PID 2516 wrote to memory of 2980	2516	NEAS.16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738exe_JC.exe	RegAsm.exe
PID 2516 wrote to memory of 2980	2516	NEAS.16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738exe_JC.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738exe_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
PID:2980

memory/2516-0-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download
memory/2516-1-0x0000000001270000-0x00000000012D2000-memory.dmp

Filesize
392KB

Download
memory/2516-2-0x0000000000760000-0x00000000007B4000-memory.dmp

Filesize
336KB

Download
memory/2516-3-0x0000000004C50000-0x0000000004C90000-memory.dmp

Filesize
256KB

Download
memory/2516-4-0x00000000003C0000-0x00000000003CA000-memory.dmp

Filesize
40KB

Download
memory/2516-5-0x00000000743A0000-0x0000000074A8E000-memory.dmp

Filesize
6.9MB

Download