Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
04/11/2023, 08:09
General
-
Target
NEAS.8c70a93f710c5c0ab79b50122022cc30.exe
-
Size
364KB
-
MD5
8c70a93f710c5c0ab79b50122022cc30
-
SHA1
aa80a2e2ddd5fba3ebfe6d918d88b3cd91a1900c
-
SHA256
5179ae5b7a8991b6359652ec6a3a7027d1f97a42bc2c220a59319814980a0a0e
-
SHA512
4924bdca4857e29a5160f0e88e4a9ad02b874f6ea7a78bb0c1a3e41119e642ca2c8a613d661cf78a3c435713b90e669b9ffb2977765383bdfd27868f95012a96
-
SSDEEP
1536:JozXF8CvrJ4PBhDP35o6hYPlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:Joh8k6DP3C6hYltOrWKDBr+yJb
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.8c70a93f710c5c0ab79b50122022cc30.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.8c70a93f710c5c0ab79b50122022cc30.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 2202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5040 -ip 50401⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
364KB
-
Filesize
364KB