7c68ca16235518d35547d82bbaaaee9db3586427dd17d2116c401ffb58549aae

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 16:47

Target

NEAS.a3bfb1b6610d2556cd79a846688deaa0.exe
Size

316KB
MD5

a3bfb1b6610d2556cd79a846688deaa0
SHA1

9658f4e2d75dd0f1f9a2b49cef02ae141b609035
SHA256

7c68ca16235518d35547d82bbaaaee9db3586427dd17d2116c401ffb58549aae
SHA512

c05e69d84f7d05773e3941163b2d63801e314c43b5da1181b4fa71d30b9d0e13c59683cee0a44473e1d793c9416571edba935ee9b18b971dc363404d3bad1c73
SSDEEP

6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGr:dMgZXNOUBXXRTOAz+Gr

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4880	NEAS.a3bfb1b6610d2556cd79a846688deaa0.exe.back

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4880	4648	NEAS.a3bfb1b6610d2556cd79a846688deaa0.exe	86
PID 4648 wrote to memory of 4880	4648	NEAS.a3bfb1b6610d2556cd79a846688deaa0.exe	86
PID 4648 wrote to memory of 4880	4648	NEAS.a3bfb1b6610d2556cd79a846688deaa0.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.a3bfb1b6610d2556cd79a846688deaa0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.a3bfb1b6610d2556cd79a846688deaa0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\NEAS.a3bfb1b6610d2556cd79a846688deaa0.exe.back
  "C:\Users\Admin\AppData\Local\Temp\NEAS.a3bfb1b6610d2556cd79a846688deaa0.exe.back"
  2⤵
  - Executes dropped EXE
  PID:4880

C:\Users\Admin\AppData\Local\Temp\NEAS.a3bfb1b6610d2556cd79a846688deaa0.exe.back

Filesize
316KB

MD5
53f2188224170cf53fd24afbfe3beb6c

SHA1
05b21aa07d0d91b6113f3388d3e03d19e5727eb6

SHA256
b297c7a3224b1d53431f15230360845c9c78438029dc4253fac14a27a8ce701b

SHA512
880ba27e686e21522368e8d2d0c1b621178b2a52292bebe91efd8b8c73607ed5b3b3c1f63d55c27c10dc58edb620c4a1781bff77ea5b861dfa02e545ca007ce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\NEAS.a3bfb1b6610d2556cd79a846688deaa0.exe.back

Filesize
316KB

MD5
53f2188224170cf53fd24afbfe3beb6c

SHA1
05b21aa07d0d91b6113f3388d3e03d19e5727eb6

SHA256
b297c7a3224b1d53431f15230360845c9c78438029dc4253fac14a27a8ce701b

SHA512
880ba27e686e21522368e8d2d0c1b621178b2a52292bebe91efd8b8c73607ed5b3b3c1f63d55c27c10dc58edb620c4a1781bff77ea5b861dfa02e545ca007ce2

Download Submit