6344e2374ab2c6fa25295db13f25eb83e0411968798bb0cda61ce1f5cc4a3d07

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2023, 19:54

Target

NEAS.5e1747e390235c6cacaf3d2b068ba050.exe
Size

888KB
MD5

5e1747e390235c6cacaf3d2b068ba050
SHA1

59173dcdcc853ea2dfce51907aa4b58655f59789
SHA256

6344e2374ab2c6fa25295db13f25eb83e0411968798bb0cda61ce1f5cc4a3d07
SHA512

8c58177b4a1ca6120bacd5821672ec782e9758ce242c4dc5e33ed7111886aae49f9d5194274affd011a4a3cd08a21eece3fcc2d32f0fa72c508e08551d8623ea
SSDEEP

6144:JQGy5HRVQq9AUTiu88UlJK5qXY3g7wCMTz75ZcwABrxxJa/YES8P:JQGyXSq9XU8UlJxwg8756jlDa/ZS8P

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3284	NEAS.5e1747e390235c6cacaf3d2b068ba050.exe

Executes dropped EXE 1 IoCs

pid	Process
3284	NEAS.5e1747e390235c6cacaf3d2b068ba050.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1896	4196	WerFault.exe	86
3032	3284	WerFault.exe	94
3420	3284	WerFault.exe	94

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4196	NEAS.5e1747e390235c6cacaf3d2b068ba050.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3284	NEAS.5e1747e390235c6cacaf3d2b068ba050.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3284	4196	NEAS.5e1747e390235c6cacaf3d2b068ba050.exe	94
PID 4196 wrote to memory of 3284	4196	NEAS.5e1747e390235c6cacaf3d2b068ba050.exe	94
PID 4196 wrote to memory of 3284	4196	NEAS.5e1747e390235c6cacaf3d2b068ba050.exe	94

C:\Users\Admin\AppData\Local\Temp\NEAS.5e1747e390235c6cacaf3d2b068ba050.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5e1747e390235c6cacaf3d2b068ba050.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 344
  2⤵
  - Program crash
  PID:1896
- C:\Users\Admin\AppData\Local\Temp\NEAS.5e1747e390235c6cacaf3d2b068ba050.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.5e1747e390235c6cacaf3d2b068ba050.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 344
    3⤵
    - Program crash
    PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 364
    3⤵
    - Program crash
    PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4196 -ip 4196
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3284 -ip 3284
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3284 -ip 3284
1⤵
PID:4784

C:\Users\Admin\AppData\Local\Temp\NEAS.5e1747e390235c6cacaf3d2b068ba050.exe

Filesize
888KB

MD5
971c93c806fc7d7131456b5e074cfeed

SHA1
18735610dab5863f7d08f3bc3e6db314213b1221

SHA256
088731edc9502852b340ebd46b55abfb6722c1a518f615f2bffb0819e5a4c5f6

SHA512
c9d663a7d8fcd983301e99374119df9ffaf91c6234416f83d2bcc6ba533171d2c2ea00c652d8aebca624e81b86d4f71ad7091dfcef1e8b03e64e471df41405da

Download Submit
memory/3284-7-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3284-8-0x00000000015C0000-0x00000000016A8000-memory.dmp

Filesize
928KB

Download
memory/3284-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4196-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4196-6-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download