38f6aea0bbc88f171e4d8c88bbafeca6f174c7ef3faf48eb7497d8db78d20d92

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 12:33

Target

NEAS.aaee6e945618d42beef3a1061e8745d0.exe
Size

462KB
MD5

aaee6e945618d42beef3a1061e8745d0
SHA1

21993ff9a13f1b3648428d99fdde831bf3a7bde4
SHA256

38f6aea0bbc88f171e4d8c88bbafeca6f174c7ef3faf48eb7497d8db78d20d92
SHA512

fb04839fb76778c3c3d86cc86cba59582bd96f3a988c24cfc66c2d3e625c97432f0e46d8ba5b08c25c1940cfa7d1ef4ad732818d1a9d2cc55e8f5b7854196810
SSDEEP

6144:zRPu8zwNAZYCZrIik3tHqwtIIqbp53ha+oQC8B/DNn0wcWsuvCs5z8F5iwPW+3PE:zJrIik3c3P3s+o9i/D+wCK18vjW59

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2680	3CC2.tmp

Loads dropped DLL 1 IoCs

pid	Process
2060	NEAS.aaee6e945618d42beef3a1061e8745d0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2680	2060	NEAS.aaee6e945618d42beef3a1061e8745d0.exe	28
PID 2060 wrote to memory of 2680	2060	NEAS.aaee6e945618d42beef3a1061e8745d0.exe	28
PID 2060 wrote to memory of 2680	2060	NEAS.aaee6e945618d42beef3a1061e8745d0.exe	28
PID 2060 wrote to memory of 2680	2060	NEAS.aaee6e945618d42beef3a1061e8745d0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.aaee6e945618d42beef3a1061e8745d0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.aaee6e945618d42beef3a1061e8745d0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\3CC2.tmp
  "C:\Users\Admin\AppData\Local\Temp\3CC2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\NEAS.aaee6e945618d42beef3a1061e8745d0.exe D7ABD4234C4093641AA073C02615774B2015CF9BB912927BBEBF3FD47F88092AC831631F77CF503F4C0BE5B3327BF07F9D47B375FD9C4285741FE47B7139F189
  2⤵
  - Executes dropped EXE
  PID:2680

C:\Users\Admin\AppData\Local\Temp\3CC2.tmp

Filesize
462KB

MD5
1594902a2737dc1ca5db708cfcacf18c

SHA1
7d13559b8e540546e953dee255beaebee3221c35

SHA256
b88360a056f5e1750dd531c02e2a4d58139407483d4e56de7a5fa25cbcc89098

SHA512
d5b630acae661930c2b5aed306f2e6833c09b14a8defb479bfcb8d5e4a69ae3552bc6ce8b3acf7ebf9c7b0d385e6c1b78f2f1d307f3bd78d09c48a927c2bac8d

Download Submit
\Users\Admin\AppData\Local\Temp\3CC2.tmp

Filesize
462KB

MD5
1594902a2737dc1ca5db708cfcacf18c

SHA1
7d13559b8e540546e953dee255beaebee3221c35

SHA256
b88360a056f5e1750dd531c02e2a4d58139407483d4e56de7a5fa25cbcc89098

SHA512
d5b630acae661930c2b5aed306f2e6833c09b14a8defb479bfcb8d5e4a69ae3552bc6ce8b3acf7ebf9c7b0d385e6c1b78f2f1d307f3bd78d09c48a927c2bac8d

Download Submit