99a71421d090363dce5aeafc9c0b3921dc30bf6c5a5fc9422296f38e205ac1f7 | Triage

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 07:57

Sharing

Report Analysis Logs

General

Target

NEAS.dcb7cccd0e5bee8b709d928b10482430.exe
Size

6KB
MD5

dcb7cccd0e5bee8b709d928b10482430
SHA1

2d44f0159b03e08e2581fd1867c3a2054ed5cb63
SHA256

99a71421d090363dce5aeafc9c0b3921dc30bf6c5a5fc9422296f38e205ac1f7
SHA512

e2ff1c7af7d477dffc65a97d6f1a2d40b91fe3d4d109f20c1ed0b1504dac6b996c9d13025ee0baf92995404a720a2c4543db22f340f660a180fcd16c95e425be
SSDEEP

96:mtHeXzmXi6StAClg/bwRvyvTrwCqiqOor:QeXanHCltvyAeor

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2628	2864	NEAS.dcb7cccd0e5bee8b709d928b10482430.exe	32
PID 2864 wrote to memory of 2628	2864	NEAS.dcb7cccd0e5bee8b709d928b10482430.exe	32
PID 2864 wrote to memory of 2628	2864	NEAS.dcb7cccd0e5bee8b709d928b10482430.exe	32

C:\Users\Admin\AppData\Local\Temp\NEAS.dcb7cccd0e5bee8b709d928b10482430.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.dcb7cccd0e5bee8b709d928b10482430.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\20231104T075734_023.exe
  2⤵
  PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads