954eed553e4c8aca69c9874074581ec95a5acf59761b43de7b7477bb5261b2be

Analysis

max time kernel
194s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2023 16:33

Target

NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe
Size

885KB
MD5

119bde2c74fbaa8d7b8f6f668e3194a0
SHA1

c51aeb5791c6c8f217833d07e31e18006160ab3a
SHA256

954eed553e4c8aca69c9874074581ec95a5acf59761b43de7b7477bb5261b2be
SHA512

26ba62d67699336953cc3dc77a654926e08450c82475728160caaf03b16f939b4049c5c5c706a2b7f5259e2cceade3153ebbfc95190069e60ef497a3d4e3dd3e
SSDEEP

6144:5rNH/9fA+WTZgg5I2Bl5K1VxZyRixD4S19/wABrxxJa/YESq:AyuHIZEip4a9/jlDa/ZSq

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3864	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Executes dropped EXE 1 IoCs

pid	Process
3864	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1684	2136	WerFault.exe	84
3808	3864	WerFault.exe	98
1516	3864	WerFault.exe	98

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2136	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3864	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3864	2136	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe	98
PID 2136 wrote to memory of 3864	2136	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe	98
PID 2136 wrote to memory of 3864	2136	NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe	98

C:\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 312
  2⤵
  - Program crash
  PID:1684
- C:\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 356
    3⤵
    - Program crash
    PID:3808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 200
    3⤵
    - Program crash
    PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2136 -ip 2136
1⤵
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3864 -ip 3864
1⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3864 -ip 3864
1⤵
PID:4364

C:\Users\Admin\AppData\Local\Temp\NEAS.119bde2c74fbaa8d7b8f6f668e3194a0.exe

Filesize
885KB

MD5
411f538e419ca0e809599cf404e3f12d

SHA1
42caee9eaaa1bad94bb93344b974c9e670bc579c

SHA256
979281e28e10d5fa8869ab1ab5fc30374be31b446eb76fd50ae3e0ec24e28f12

SHA512
1d862629609c0c7092015bbf24be12d36d087e6f5b6531a0a670f92db60552bcd19456d92f4a8dd2133fee8ef15f8edf563c985d1b33eb5d5bb430bf57675071

Download Submit
memory/2136-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2136-6-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3864-7-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3864-8-0x0000000004E30000-0x0000000004F18000-memory.dmp

Filesize
928KB

Download
memory/3864-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download