51aa95a613f55edafa19209750b3ab9ca93a91d0961a07a988942fe34f763824

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 09:00

Target

NEAS.edf1a7b2fb104b0eb8894fda4a213520.exe
Size

5KB
MD5

edf1a7b2fb104b0eb8894fda4a213520
SHA1

641b0149e7f746904e7a6a6344864438abb4884c
SHA256

51aa95a613f55edafa19209750b3ab9ca93a91d0961a07a988942fe34f763824
SHA512

637dcdb79c5d7b5b0a01d0fc5c0d4d0ee96820d8a98ddf579fa11539bb343683eb8c31e6002b1135ce6422734f78906e96bad50e2836535f0813111aca7deed4
SSDEEP

96:6VhtHwXPIJ4Sv3Rc0jFkeJWTOMTrdH40L0ror:6VLwXDWhc0TJWTObor

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3808	svchost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 1656	3312	NEAS.edf1a7b2fb104b0eb8894fda4a213520.exe	98
PID 3312 wrote to memory of 1656	3312	NEAS.edf1a7b2fb104b0eb8894fda4a213520.exe	98

C:\Users\Admin\AppData\Local\Temp\NEAS.edf1a7b2fb104b0eb8894fda4a213520.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.edf1a7b2fb104b0eb8894fda4a213520.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\20231031T121853_405.exe
  2⤵
  PID:1656

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3808

memory/3808-0-0x00000205AAF40000-0x00000205AAF50000-memory.dmp

Filesize
64KB

Download
memory/3808-16-0x00000205AB040000-0x00000205AB050000-memory.dmp

Filesize
64KB

Download
memory/3808-32-0x00000205B3370000-0x00000205B3371000-memory.dmp

Filesize
4KB

Download
memory/3808-34-0x00000205B33A0000-0x00000205B33A1000-memory.dmp

Filesize
4KB

Download
memory/3808-35-0x00000205B33A0000-0x00000205B33A1000-memory.dmp

Filesize
4KB

Download
memory/3808-36-0x00000205B34B0000-0x00000205B34B1000-memory.dmp

Filesize
4KB

Download