Analysis
-
max time kernel
152s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
03-11-2023 18:27
General
-
Target
NEAS.d5c7c3f5d8a3cb6ec5b4f05dc18ddf1591544be8007cb17dbcb11d98701cfb1dexe_JC.exe
-
Size
1.4MB
-
MD5
d2105231b50a87133f07d340d30711ea
-
SHA1
a933024e21d0792033ead30b1c72a5b243688595
-
SHA256
d5c7c3f5d8a3cb6ec5b4f05dc18ddf1591544be8007cb17dbcb11d98701cfb1d
-
SHA512
80539fb6c7a731111b923fd226c02022b929476eddca02f8df8cd9695e99aad3dcd1c6606e65c2559643333d183fa6864c75c9dd05a9acc81348c2ca8716b825
-
SSDEEP
24576:JTZ9M31t0GtNco35IvemcWv1YL57PWNEjlcd7bjgpgVeHqj:39M31t0qHpgVeo
Score
3/10
Malware Config
Signatures
-
Program crash 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d5c7c3f5d8a3cb6ec5b4f05dc18ddf1591544be8007cb17dbcb11d98701cfb1dexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d5c7c3f5d8a3cb6ec5b4f05dc18ddf1591544be8007cb17dbcb11d98701cfb1dexe_JC.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 15722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 15722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5036 -ip 50361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5036 -ip 50361⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
1.4MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB