4b6fcdcbaf3e6af907641dfe7974b692910a620ffd5cb318197ba0834f5ab896

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 14:09

Target

NEAS.5bb6f16ee83855fed7c981d7d68ab860.exe
Size

467KB
MD5

5bb6f16ee83855fed7c981d7d68ab860
SHA1

668a397f8859e6e18b01b6d30a40b38a352e5ffa
SHA256

4b6fcdcbaf3e6af907641dfe7974b692910a620ffd5cb318197ba0834f5ab896
SHA512

c242ffca43a149118883e1fcff19ac2062842c1278bbefba3656708f8af2badb726ddae2668f339f9272e806e19b5f1fdc075b64abc428d7f9f7044de1d7ed56
SSDEEP

12288:pWBm+95nHfF2mgewFX5bAJGMFKC/+Kbw:pWBz95ndbgfX5bkGgKCzbw

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4048	E9B4.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 4048	1560	NEAS.5bb6f16ee83855fed7c981d7d68ab860.exe	84
PID 1560 wrote to memory of 4048	1560	NEAS.5bb6f16ee83855fed7c981d7d68ab860.exe	84
PID 1560 wrote to memory of 4048	1560	NEAS.5bb6f16ee83855fed7c981d7d68ab860.exe	84

C:\Users\Admin\AppData\Local\Temp\NEAS.5bb6f16ee83855fed7c981d7d68ab860.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5bb6f16ee83855fed7c981d7d68ab860.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Local\Temp\E9B4.tmp
  "C:\Users\Admin\AppData\Local\Temp\E9B4.tmp" --pingC:\Users\Admin\AppData\Local\Temp\NEAS.5bb6f16ee83855fed7c981d7d68ab860.exe 86EFB49E6FAE5E551B410C10ADE20D59244AE98C647624A87A2C35C1936B7831E7296543250AE00C59915191A0F72CD4CB55450B42446E91FEE1662142F47C8A
  2⤵
  - Executes dropped EXE
  PID:4048

C:\Users\Admin\AppData\Local\Temp\E9B4.tmp

Filesize
467KB

MD5
ccf79fca79c27b1d91687d70a2ec61db

SHA1
06664d8a10022174d90d2aa5e1fe833732319198

SHA256
4bd6508b8a79a346e3f9a8b965ccb9df81f9e09e1ad2e1ad7f133d80678950de

SHA512
22f6c1e14bdae3073f52b05e3ecd588b7eac934d14a7058736852bc73d20b93e6e521cb862d6aa7ae8aac47a26026f88f3c2a9b9e5a5214937f6b2b603001578

Download Submit
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp

Filesize
467KB

MD5
ccf79fca79c27b1d91687d70a2ec61db

SHA1
06664d8a10022174d90d2aa5e1fe833732319198

SHA256
4bd6508b8a79a346e3f9a8b965ccb9df81f9e09e1ad2e1ad7f133d80678950de

SHA512
22f6c1e14bdae3073f52b05e3ecd588b7eac934d14a7058736852bc73d20b93e6e521cb862d6aa7ae8aac47a26026f88f3c2a9b9e5a5214937f6b2b603001578

Download Submit
memory/1560-0-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1560-4-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4048-5-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4048-8-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download