2ad90bd0574d09867ad1806ba796e582d661856bcf93bbc394ffff8ecb1c82da

Analysis

max time kernel
128s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 14:12

Target

NEAS.7b3be09d9c3546fe2410b8adfecd9cb0.exe
Size

885KB
MD5

7b3be09d9c3546fe2410b8adfecd9cb0
SHA1

3b5081aa3e097b7cbf35898f5c41606659844bd3
SHA256

2ad90bd0574d09867ad1806ba796e582d661856bcf93bbc394ffff8ecb1c82da
SHA512

80d66a250a48cf607f33d43791b0f30a14f59f6becec54de967d2a6bac566891e3a9506ae529c578448e4ebca6de20fe9e06015dbf9e587dfe16342eb12daf8a
SSDEEP

6144:zQGy5HRVQq9NUTiu88UlJK5qXY3g7wCMTz75ZSwABrxxJa/YESy:zQGyXSq90U8UlJxwg875kjlDa/ZSy

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4508	NEAS.7b3be09d9c3546fe2410b8adfecd9cb0.exe

Executes dropped EXE 1 IoCs

pid	Process
4508	NEAS.7b3be09d9c3546fe2410b8adfecd9cb0.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
632	4504	WerFault.exe	84
2200	4508	WerFault.exe	92
2660	4508	WerFault.exe	92

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4504	NEAS.7b3be09d9c3546fe2410b8adfecd9cb0.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4508	NEAS.7b3be09d9c3546fe2410b8adfecd9cb0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4508	4504	NEAS.7b3be09d9c3546fe2410b8adfecd9cb0.exe	92
PID 4504 wrote to memory of 4508	4504	NEAS.7b3be09d9c3546fe2410b8adfecd9cb0.exe	92
PID 4504 wrote to memory of 4508	4504	NEAS.7b3be09d9c3546fe2410b8adfecd9cb0.exe	92

C:\Users\Admin\AppData\Local\Temp\NEAS.7b3be09d9c3546fe2410b8adfecd9cb0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7b3be09d9c3546fe2410b8adfecd9cb0.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 352
  2⤵
  - Program crash
  PID:632
- C:\Users\Admin\AppData\Local\Temp\NEAS.7b3be09d9c3546fe2410b8adfecd9cb0.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.7b3be09d9c3546fe2410b8adfecd9cb0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 200
    3⤵
    - Program crash
    PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 380
    3⤵
    - Program crash
    PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4504 -ip 4504
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4508 -ip 4508
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4508 -ip 4508
1⤵
PID:1324

C:\Users\Admin\AppData\Local\Temp\NEAS.7b3be09d9c3546fe2410b8adfecd9cb0.exe

Filesize
885KB

MD5
a133f942c0f20d9e02e5e260719123d5

SHA1
e3aea52d82e4d8b410621933fc79a2061852d1b9

SHA256
9ec592bcb3400ac792bc977236191275063f30a07efdb0f9c54e4eb7c653887b

SHA512
24fc0c5cb7f039ccf7c5d2dcbb2395ad0f4f02225d06c7083b6fb24ff549c19f1050a09badaaa65416e181f1a59232547c1495d9c4f6413709098a8094df12e0

Download Submit
memory/4504-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4504-6-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4508-7-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4508-8-0x0000000004FE0000-0x00000000050C8000-memory.dmp

Filesize
928KB

Download
memory/4508-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download