b8954e91e06112ed6022f8575c0d16ee3da7c67286ef91e51a092e231b1ef393

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
28/10/2023, 20:16

Target

NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe
Size

316KB
MD5

e348631fdb7bb5dd9c19e4f86860bcd0
SHA1

3dbc5c20721f4978d8ae88356edc74ea68c6d8b5
SHA256

b8954e91e06112ed6022f8575c0d16ee3da7c67286ef91e51a092e231b1ef393
SHA512

4cee0d4b39173cdc9cc490086f9c68b6d238522f30fb70eedf29b230f96811767a13b19c43c4aca5e4784f4403056755a12e4ed0843af90b1f970d3e500a61cd
SSDEEP

6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGE:dMgZXNOUBXXRTOAz+GE

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3040	NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe.back

Loads dropped DLL 1 IoCs

pid	Process
2976	NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3040	2976	NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe	28
PID 2976 wrote to memory of 3040	2976	NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe	28
PID 2976 wrote to memory of 3040	2976	NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe	28
PID 2976 wrote to memory of 3040	2976	NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe.back
  "C:\Users\Admin\AppData\Local\Temp\NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe.back"
  2⤵
  - Executes dropped EXE
  PID:3040

C:\Users\Admin\AppData\Local\Temp\NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe.back

Filesize
316KB

MD5
5c9fb4ac6a8344c5a2abfcd53f4bb7f9

SHA1
118c9e887f13b724d2861baba2cc86e255381ccd

SHA256
095eaaa995170a2b4673023bf53b547d699874a7adb7b7bb5055c7832c631bbb

SHA512
42016c29b8033f8b534fb11d693168d8d0d049edce83533886ee72ff0e1baacfad92680714cf9bc693ebff9bc516065f036b7d5f40e325effc68c5aa7c65dbcf

Download Submit
\Users\Admin\AppData\Local\Temp\NEAS.e348631fdb7bb5dd9c19e4f86860bcd0.exe.back

Filesize
316KB

MD5
5c9fb4ac6a8344c5a2abfcd53f4bb7f9

SHA1
118c9e887f13b724d2861baba2cc86e255381ccd

SHA256
095eaaa995170a2b4673023bf53b547d699874a7adb7b7bb5055c7832c631bbb

SHA512
42016c29b8033f8b534fb11d693168d8d0d049edce83533886ee72ff0e1baacfad92680714cf9bc693ebff9bc516065f036b7d5f40e325effc68c5aa7c65dbcf

Download Submit