88e7e5292ca05bee69aa73d81380be68ba891b64c7781ab956f08d51f34c2ff9

Analysis

max time kernel
151s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 10:21

Target

NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe
Size

96KB
MD5

14da044e3c9bf6738eb53e683fb62ed0
SHA1

7ad779625d816425d1013c28bae585c995f870a3
SHA256

88e7e5292ca05bee69aa73d81380be68ba891b64c7781ab956f08d51f34c2ff9
SHA512

efc6145ea6a2c50deaabfafd5719bad42139965518f1f5718814177661dc9a7f32ae81845cf3751b704c42aff3bdfb953b8fff007194d03634296d2013d707be
SSDEEP

1536:mkl4iLa+eN/Pn4pky9zWTJKh1VHX2OP/mnBk+59WiP1Lq3W:mkiiLaJNnnkkozRVHGOPeWHiNWW

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4128 set thread context of 2952	4128	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	85

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4128	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 2952	4128	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	85
PID 4128 wrote to memory of 2952	4128	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	85
PID 4128 wrote to memory of 2952	4128	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	85
PID 4128 wrote to memory of 2952	4128	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	85
PID 4128 wrote to memory of 2952	4128	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	85
PID 4128 wrote to memory of 2952	4128	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	85
PID 4128 wrote to memory of 2952	4128	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	85
PID 4128 wrote to memory of 2952	4128	NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe	85

C:\Users\Admin\AppData\Local\Temp\NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.14da044e3c9bf6738eb53e683fb62ed0.exe
  2⤵
  PID:2952

memory/2952-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2952-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2952-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2952-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download