8c449334f685abd73281fdeffca0aaf54914b58a8d7edb95ce061305c70fce24

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 21:33

Target

NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe
Size

1.3MB
MD5

0259d1ed6d8d24e218b1aac2e777a040
SHA1

3ed1d4e903e50cfbb07a24b6ecf0ceefaf3e92b0
SHA256

8c449334f685abd73281fdeffca0aaf54914b58a8d7edb95ce061305c70fce24
SHA512

9b7146059ccac05b326c579f2efc724ad216e00e3ee67a146bce2342e6e8e69e2b0a9ec07256a58808b82487f4588284ec5deaf1fa021f2df315bd87fc252d14
SSDEEP

24576:5tV+cLO2JcXNylSYMe0w75KcScgvsDumSC3jX6kwiOFNZC3julwF2q:5tV+iP7IcgvOz3jX6kdOFPC3jhFr

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1748-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1748-16-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1748 set thread context of 1168	1748	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	1168	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1748	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1168	1748	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	28
PID 1748 wrote to memory of 1168	1748	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	28
PID 1748 wrote to memory of 1168	1748	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	28
PID 1748 wrote to memory of 1168	1748	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	28
PID 1748 wrote to memory of 1168	1748	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	28
PID 1748 wrote to memory of 1168	1748	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	28
PID 1748 wrote to memory of 1168	1748	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	28
PID 1748 wrote to memory of 1168	1748	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	28
PID 1748 wrote to memory of 1168	1748	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	28
PID 1748 wrote to memory of 1168	1748	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	28
PID 1168 wrote to memory of 2892	1168	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	29
PID 1168 wrote to memory of 2892	1168	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	29
PID 1168 wrote to memory of 2892	1168	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	29
PID 1168 wrote to memory of 2892	1168	NEAS.0259d1ed6d8d24e218b1aac2e777a040_JC.exe	29

memory/1168-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1168-3-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1168-5-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1168-7-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1168-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1168-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1168-14-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1168-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1168-19-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1168-18-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1168-22-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1748-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1748-16-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download