d16e1b9eccf969a9879992bd9eab8d2d97381e9ad58a7a4e538bc7abc52ef476

Analysis

max time kernel
126s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 16:41

Target

NEAS.2d88c63c3e8acbd346c42b51b269a5f0.exe
Size

316KB
MD5

2d88c63c3e8acbd346c42b51b269a5f0
SHA1

b5e407cd1bf36555a50762d5ac8890e5820b935d
SHA256

d16e1b9eccf969a9879992bd9eab8d2d97381e9ad58a7a4e538bc7abc52ef476
SHA512

46995ccfd4e380cde5f67dc7dc8c1da94e3df3b2f7cdd81ddc1ebf91fd7cd759a1cce68d8a17d655f2a130ee852a57bd80835d8f78aceb3d09f5a0ab9be1131e
SSDEEP

6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGe:dMgZXNOUBXXRTOAz+Ge

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3132	NEAS.2d88c63c3e8acbd346c42b51b269a5f0.exe.back

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 3132	1580	NEAS.2d88c63c3e8acbd346c42b51b269a5f0.exe	86
PID 1580 wrote to memory of 3132	1580	NEAS.2d88c63c3e8acbd346c42b51b269a5f0.exe	86
PID 1580 wrote to memory of 3132	1580	NEAS.2d88c63c3e8acbd346c42b51b269a5f0.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.2d88c63c3e8acbd346c42b51b269a5f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2d88c63c3e8acbd346c42b51b269a5f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Local\Temp\NEAS.2d88c63c3e8acbd346c42b51b269a5f0.exe.back
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2d88c63c3e8acbd346c42b51b269a5f0.exe.back"
  2⤵
  - Executes dropped EXE
  PID:3132

C:\Users\Admin\AppData\Local\Temp\NEAS.2d88c63c3e8acbd346c42b51b269a5f0.exe.back

Filesize
316KB

MD5
5e8f834e91cb0858c69c3d8a2f58ba42

SHA1
6329c14efc5acadf680959e990b298fdf002906f

SHA256
c22b1148ca96163f2af6999926b9a674b8f310e75fc4e6227ce503a5fd95d540

SHA512
b6dc00c378282a3b886459bdb7289a2d57b501829bca6bdfd2b986deef506110b7a1d60a4f74855deae4105413681bd00132aedca89e3fb6418e563ca17ea19f

Download Submit
C:\Users\Admin\AppData\Local\Temp\NEAS.2d88c63c3e8acbd346c42b51b269a5f0.exe.back

Filesize
316KB

MD5
5e8f834e91cb0858c69c3d8a2f58ba42

SHA1
6329c14efc5acadf680959e990b298fdf002906f

SHA256
c22b1148ca96163f2af6999926b9a674b8f310e75fc4e6227ce503a5fd95d540

SHA512
b6dc00c378282a3b886459bdb7289a2d57b501829bca6bdfd2b986deef506110b7a1d60a4f74855deae4105413681bd00132aedca89e3fb6418e563ca17ea19f

Download Submit