f977351f250f88763ed30b2711ea8893e28be04187108c82b07c43a216662566

Analysis

max time kernel
158s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 11:16

Target

NEAS.307af961e3da8ad56115b858b45ca360_JC.exe
Size

2.0MB
MD5

307af961e3da8ad56115b858b45ca360
SHA1

b236e94182209e94688483c3857ee5da05ad24b2
SHA256

f977351f250f88763ed30b2711ea8893e28be04187108c82b07c43a216662566
SHA512

1b2d84072c3c0f87d8f6ead316e784f878d09270aeaac80465703a3d791b2a14d1099aca20e4321b90581609ea50b77ceb59a7f7333d49b1122a104b401888a6
SSDEEP

24576:z7FUDowAyrTVE3U5F7j55944ECgR721unTeddf7vmwp77Tq14lD2ex+:zBuZrEUb75QbnTOdf73Tq1sjI

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2768	NEAS.307af961e3da8ad56115b858b45ca360_JC.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 2768	4184	NEAS.307af961e3da8ad56115b858b45ca360_JC.exe	88
PID 4184 wrote to memory of 2768	4184	NEAS.307af961e3da8ad56115b858b45ca360_JC.exe	88
PID 4184 wrote to memory of 2768	4184	NEAS.307af961e3da8ad56115b858b45ca360_JC.exe	88

C:\Users\Admin\AppData\Local\Temp\NEAS.307af961e3da8ad56115b858b45ca360_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.307af961e3da8ad56115b858b45ca360_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Users\Admin\AppData\Local\Temp\is-73MS3.tmp\NEAS.307af961e3da8ad56115b858b45ca360_JC.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-73MS3.tmp\NEAS.307af961e3da8ad56115b858b45ca360_JC.tmp" /SL5="$C022C,1047040,0,C:\Users\Admin\AppData\Local\Temp\NEAS.307af961e3da8ad56115b858b45ca360_JC.exe"
  2⤵
  - Executes dropped EXE
  PID:2768

C:\Users\Admin\AppData\Local\Temp\is-73MS3.tmp\NEAS.307af961e3da8ad56115b858b45ca360_JC.tmp

Filesize
3.2MB

MD5
7ddf41f631883c24a28486de5afb0d51

SHA1
45fa51dc1a7e0a90aa105adb7b13fcb5248fcd70

SHA256
6112140641c5c361cf4f9aff4f9900daa6e3e2ef3ebac4125be558f1822ab883

SHA512
a5d6e2b789b8fb82de2d868dfa851629a950771c1802a0af84ba7f74ce039e67e5332433ef116b904f1ffaa6ca60ba3ff349ef0ed1c01a02726d080e5a818807

Download Submit
memory/2768-6-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/2768-9-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/2768-10-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/4184-1-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/4184-8-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download