3c52b42cf7005f0a9091e2dd0b1b3cd41d35c8b469252d4519553e81a16a56bd

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 14:19

Target

NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe
Size

1.2MB
MD5

c6b5e1e08854161eff9c75247bbb9de0
SHA1

32444db9eaba072b09446330e1d99014f8d97e97
SHA256

3c52b42cf7005f0a9091e2dd0b1b3cd41d35c8b469252d4519553e81a16a56bd
SHA512

14f8f92ff504b32b6bf753582dadea484579a74d0f4bcf3da970ba04ee2968f9d8578e0d5bed91683a262925d1ec4bc45972ceff77482ff66f677f361783ce9c
SSDEEP

24576:7zXKqa8SEijjC+37liXbLbklmfB6/tbQdSmKeJ0xViDJOVH7Ruz:7z6qaakjC+3srLAKB61bQd3Kea0JOZ7W

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2456	bmtqtgjh.exe

Loads dropped DLL 1 IoCs

pid	Process
2164	NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ewqbbqrs\bmtqtgjh.exe	NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2456	2164	NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe	28
PID 2164 wrote to memory of 2456	2164	NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe	28
PID 2164 wrote to memory of 2456	2164	NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe	28
PID 2164 wrote to memory of 2456	2164	NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\ewqbbqrs\bmtqtgjh.exe
  "C:\Program Files (x86)\ewqbbqrs\bmtqtgjh.exe"
  2⤵
  - Executes dropped EXE
  PID:2456

C:\Program Files (x86)\ewqbbqrs\bmtqtgjh.exe

Filesize
1.3MB

MD5
bc34e95e57cf74fb1f8d425b037427a7

SHA1
3603b412db9250d0b814885ea3f123f1b4f6c5b9

SHA256
eba52648753aa0a3e29dec1daafa94e2583126475f7dea5b30628a834512fc01

SHA512
b39f4ef490dbba6c296ffe2426985d986d857addf3f8c4920dae6aa36a2cb69d8126ee4ad2db9509ca109ab0c95cc2a7aeeab1304733739fac336762bf1e9e5c

Download Submit
\Program Files (x86)\ewqbbqrs\bmtqtgjh.exe

Filesize
1.3MB

MD5
bc34e95e57cf74fb1f8d425b037427a7

SHA1
3603b412db9250d0b814885ea3f123f1b4f6c5b9

SHA256
eba52648753aa0a3e29dec1daafa94e2583126475f7dea5b30628a834512fc01

SHA512
b39f4ef490dbba6c296ffe2426985d986d857addf3f8c4920dae6aa36a2cb69d8126ee4ad2db9509ca109ab0c95cc2a7aeeab1304733739fac336762bf1e9e5c

Download Submit
memory/2164-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2164-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2164-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2456-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2456-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download