88e7e5292ca05bee69aa73d81380be68ba891b64c7781ab956f08d51f34c2ff9

Analysis

max time kernel
147s
max time network
163s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
03-11-2023 10:21

Target

NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe
Size

96KB
MD5

14da044e3c9bf6738eb53e683fb62ed0
SHA1

7ad779625d816425d1013c28bae585c995f870a3
SHA256

88e7e5292ca05bee69aa73d81380be68ba891b64c7781ab956f08d51f34c2ff9
SHA512

efc6145ea6a2c50deaabfafd5719bad42139965518f1f5718814177661dc9a7f32ae81845cf3751b704c42aff3bdfb953b8fff007194d03634296d2013d707be
SSDEEP

1536:mkl4iLa+eN/Pn4pky9zWTJKh1VHX2OP/mnBk+59WiP1Lq3W:mkiiLaJNnnkkozRVHGOPeWHiNWW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2096 set thread context of 1804	2096	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2096	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1804	2096	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	28
PID 2096 wrote to memory of 1804	2096	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	28
PID 2096 wrote to memory of 1804	2096	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	28
PID 2096 wrote to memory of 1804	2096	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	28
PID 2096 wrote to memory of 1804	2096	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	28
PID 2096 wrote to memory of 1804	2096	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	28
PID 2096 wrote to memory of 1804	2096	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	28
PID 2096 wrote to memory of 1804	2096	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	28
PID 2096 wrote to memory of 1804	2096	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe
  2⤵
  PID:1804

memory/1804-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1804-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1804-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1804-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1804-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1804-10-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1804-12-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1804-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1804-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download