649c1149abc18d368ecbfbd6686d0835b5ee40a1fc81b7fac180426687a6d49b

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 16:42

Target

NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe
Size

896KB
MD5

41a7f01f6a2aa59eacafa70d9f8413e0
SHA1

34379ee306479cfecd43e88b06f1ec80c81c53d0
SHA256

649c1149abc18d368ecbfbd6686d0835b5ee40a1fc81b7fac180426687a6d49b
SHA512

11ac5cfd1aa6becbd57915db40c14d9d880275b1004ee4b8354aebfcab51eb21bd08ac7ca932cd15653fe992b7e17d1222d21dde2090ff740a7272d878d0651e
SSDEEP

12288:Xy7G7Sok++skWlVijs/92v8j7MjlDa/ZSP:XyK7Fk0Vig/9a8j7Ca/ZSP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4640	NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe

Executes dropped EXE 1 IoCs

pid	Process
4640	NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1212	3076	WerFault.exe	88
116	4640	WerFault.exe	99
1128	4640	WerFault.exe	99

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3076	NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4640	NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 4640	3076	NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe	99
PID 3076 wrote to memory of 4640	3076	NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe	99
PID 3076 wrote to memory of 4640	3076	NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe	99

C:\Users\Admin\AppData\Local\Temp\NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 348
  2⤵
  - Program crash
  PID:1212
- C:\Users\Admin\AppData\Local\Temp\NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 344
    3⤵
    - Program crash
    PID:116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 348
    3⤵
    - Program crash
    PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3076 -ip 3076
1⤵
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4640 -ip 4640
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4640 -ip 4640
1⤵
PID:4500

C:\Users\Admin\AppData\Local\Temp\NEAS.41a7f01f6a2aa59eacafa70d9f8413e0.exe

Filesize
896KB

MD5
08eadaba9e3a4f447465f40ef85f5710

SHA1
cbdf951a3eafbab54b7436de40ba2d41edfae2e1

SHA256
efc49674b16ad490a57fb2d320a6d3e5fe8db946040c691fe2c69fc484840b7d

SHA512
6e8ea92edfbdf6f3189cebe5b9bc1b2ea7e4bb54331b0eda589ec1b630ef52d1a37189277fec278bff34e1646f8bb9edbab928bf9d1135df6d476f314ce60215

Download Submit
memory/3076-0-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/3076-6-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4640-7-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4640-8-0x0000000004FA0000-0x000000000508D000-memory.dmp

Filesize
948KB

Download
memory/4640-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download