Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
31/10/2023, 08:40
General
-
Target
NEAS.e59f37dba962f36082dae99505bec428.exe
-
Size
724KB
-
MD5
e59f37dba962f36082dae99505bec428
-
SHA1
2ebc19e85373450223f7ecf2c4a2468dcf4eba77
-
SHA256
a8d1ff6b567ee38f7e2f546a1bd282693c04aa9646148b4dc79556a04a5645b8
-
SHA512
21af972e1385246cceccbdb6f19fa723fa0d24f2a780fc8a2094514a72448b40344861b378b2760a139d71d2668cf2b831d260e97f9fc7c992cbaea811bbaca4
-
SSDEEP
12288:s+GLQEk+d/nn8qVCEdmIE68XNmI5ZGheekrvh/H6tr9o9dSZmK2SNM9KrJ12KRNI:fGPJCiO1EYew4YaTNM9Q1R9iuLGkE
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e59f37dba962f36082dae99505bec428.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e59f37dba962f36082dae99505bec428.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 6082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 6082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3236 -ip 32361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3236 -ip 32361⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
-
Filesize
1.6MB
-
Filesize
960KB
-
Filesize
908KB
-
Filesize
144KB
-
Filesize
488KB
-
Filesize
2.1MB