ee661c289ec3a83a455e7038c6b150d1d4754217b881c2b029befb9b23addd92

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 13:10

Target

NEAS.4e6d3a51f40805dd99db92631febb230_JC.exe
Size

91KB
MD5

4e6d3a51f40805dd99db92631febb230
SHA1

1308a99d41392df8705e23a0ed1e97e4ecea0ee3
SHA256

ee661c289ec3a83a455e7038c6b150d1d4754217b881c2b029befb9b23addd92
SHA512

ad0376b43c300052ab39edf084a4dab74c2e2b12d440bc56be30cfc2bf09441db4aa4cd11a8705eed9bc2ce3c80afa45318478d13e9a753d6e3d779a21e8a9ae
SSDEEP

1536:wKmhBB38T9lpTn9IzwZ2o3JFr83PyL+386sWcSYdXh3BiE3:4BBMTrpDkwZ2o3J2KL+mSiXVBiE3

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	NEAS.4e6d3a51f40805dd99db92631febb230_JC.exe
Token: SeShutdownPrivilege	1212	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1212	Explorer.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1212	1964	NEAS.4e6d3a51f40805dd99db92631febb230_JC.exe	11
PID 1964 wrote to memory of 1212	1964	NEAS.4e6d3a51f40805dd99db92631febb230_JC.exe	11
PID 1964 wrote to memory of 1212	1964	NEAS.4e6d3a51f40805dd99db92631febb230_JC.exe	11
PID 1964 wrote to memory of 1212	1964	NEAS.4e6d3a51f40805dd99db92631febb230_JC.exe	11
PID 1212 wrote to memory of 2376	1212	Explorer.EXE	29
PID 1212 wrote to memory of 2376	1212	Explorer.EXE	29
PID 1212 wrote to memory of 2376	1212	Explorer.EXE	29

memory/1212-0-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/1212-4-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download