3c52b42cf7005f0a9091e2dd0b1b3cd41d35c8b469252d4519553e81a16a56bd

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 14:19

Target

NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe
Size

1.2MB
MD5

c6b5e1e08854161eff9c75247bbb9de0
SHA1

32444db9eaba072b09446330e1d99014f8d97e97
SHA256

3c52b42cf7005f0a9091e2dd0b1b3cd41d35c8b469252d4519553e81a16a56bd
SHA512

14f8f92ff504b32b6bf753582dadea484579a74d0f4bcf3da970ba04ee2968f9d8578e0d5bed91683a262925d1ec4bc45972ceff77482ff66f677f361783ce9c
SSDEEP

24576:7zXKqa8SEijjC+37liXbLbklmfB6/tbQdSmKeJ0xViDJOVH7Ruz:7z6qaakjC+3srLAKB61bQd3Kea0JOZ7W

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3124	hxrzgfgdgzmm.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\lmacq\hxrzgfgdgzmm.exe	NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 3124	3660	NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe	90
PID 3660 wrote to memory of 3124	3660	NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe	90
PID 3660 wrote to memory of 3124	3660	NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe	90

C:\Users\Admin\AppData\Local\Temp\NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c6b5e1e08854161eff9c75247bbb9de0.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\lmacq\hxrzgfgdgzmm.exe
  "C:\Program Files (x86)\lmacq\hxrzgfgdgzmm.exe"
  2⤵
  - Executes dropped EXE
  PID:3124

C:\Program Files (x86)\lmacq\hxrzgfgdgzmm.exe

Filesize
1.2MB

MD5
cad1db5e20e9ab6841991c7f939f03ad

SHA1
ee7e3b8b4fd9bfd95aacf707d45152f1611e6bc1

SHA256
12c57002f482c60a1603bd4acf715fc17f617ebf40b11ad00b7e39e2e4323f80

SHA512
553ad41282a7837f276043573a2e9d12099bea8d651ee0dd789a2e7e89da0832c0952af3ce4b3e5c005f0f9a236ad78cab1ada2d4026cc0e97aa529760f2db5f

Download Submit
C:\Program Files (x86)\lmacq\hxrzgfgdgzmm.exe

Filesize
1.2MB

MD5
cad1db5e20e9ab6841991c7f939f03ad

SHA1
ee7e3b8b4fd9bfd95aacf707d45152f1611e6bc1

SHA256
12c57002f482c60a1603bd4acf715fc17f617ebf40b11ad00b7e39e2e4323f80

SHA512
553ad41282a7837f276043573a2e9d12099bea8d651ee0dd789a2e7e89da0832c0952af3ce4b3e5c005f0f9a236ad78cab1ada2d4026cc0e97aa529760f2db5f

Download Submit
memory/3124-7-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3124-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3660-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3660-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3660-5-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download