e2b4c9c556a3a49006f46c0ab46b9c3c4a428f45064061d1fb836851cf24907a

Analysis

max time kernel
139s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 08:58

Target

NEAS.c6f901f574c285728ee02f6551532690.exe
Size

5KB
MD5

c6f901f574c285728ee02f6551532690
SHA1

24a6e09f90358f10a35501a6d34fbf1e0c656720
SHA256

e2b4c9c556a3a49006f46c0ab46b9c3c4a428f45064061d1fb836851cf24907a
SHA512

e19d0108ae8d7d787904e726bc30ef9db85aff4ddcdef98d7d9af87100739528e790a692d74a79d7040e87e29e495730ebec243449a8736d672f4f084c888ccf
SSDEEP

48:6aXAtHKWXRkz+WDiSODn9Q8vRWizukEGvltT8NyTrg7lKIiKIH9orw20ylL:PAtHnXRx0iSOD9R/VNtYwTrk7i7dorn

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3980	4740	NEAS.c6f901f574c285728ee02f6551532690.exe	95
PID 4740 wrote to memory of 3980	4740	NEAS.c6f901f574c285728ee02f6551532690.exe	95

C:\Users\Admin\AppData\Local\Temp\NEAS.c6f901f574c285728ee02f6551532690.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c6f901f574c285728ee02f6551532690.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\20231031T114659_680.exe
  2⤵
  PID:3980