39b902c7f2684b5faf01bb3872ddd4fd4066f15553e6b009a9be0fef85928b2c

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2023 14:14

Target

NEAS.8b48a1b5a19cb1e67f43c81386fa26d0.exe
Size

325KB
MD5

8b48a1b5a19cb1e67f43c81386fa26d0
SHA1

bb8d38a056d805d0f10fbdbe810f968ff3b9d184
SHA256

39b902c7f2684b5faf01bb3872ddd4fd4066f15553e6b009a9be0fef85928b2c
SHA512

361cac8ab1d20df90dd498c6cee0f0b0a8a1716b88a0ce437c48defe16c48e416bb3a4e75e97d659fe06d10c26d5dbc0b08a1146283265e8c1da6c744883c2e7
SSDEEP

6144:ZYgZdcJZs091uPFP1QpCT0LurJH1l3ZwzaKAG6cz9eswTfmr/yruO:ZY1JKIMlypCgiFJxlcz9eswT0hO

Score

1^/10

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4976	NEAS.8b48a1b5a19cb1e67f43c81386fa26d0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3232	4976	NEAS.8b48a1b5a19cb1e67f43c81386fa26d0.exe	86
PID 4976 wrote to memory of 3232	4976	NEAS.8b48a1b5a19cb1e67f43c81386fa26d0.exe	86
PID 4976 wrote to memory of 3232	4976	NEAS.8b48a1b5a19cb1e67f43c81386fa26d0.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.8b48a1b5a19cb1e67f43c81386fa26d0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.8b48a1b5a19cb1e67f43c81386fa26d0.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Users\Admin\AppData\Local\Temp\NEAS.8b48a1b5a19cb1e67f43c81386fa26d0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.8b48a1b5a19cb1e67f43c81386fa26d0.exe"
  2⤵
  PID:3232

memory/3232-1-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3232-3-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3232-4-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3232-5-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4976-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4976-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download