99a71421d090363dce5aeafc9c0b3921dc30bf6c5a5fc9422296f38e205ac1f7 | Triage

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 07:57

Sharing

Report Analysis Logs

General

Target

NEAS.dcb7cccd0e5bee8b709d928b10482430.exe
Size

6KB
MD5

dcb7cccd0e5bee8b709d928b10482430
SHA1

2d44f0159b03e08e2581fd1867c3a2054ed5cb63
SHA256

99a71421d090363dce5aeafc9c0b3921dc30bf6c5a5fc9422296f38e205ac1f7
SHA512

e2ff1c7af7d477dffc65a97d6f1a2d40b91fe3d4d109f20c1ed0b1504dac6b996c9d13025ee0baf92995404a720a2c4543db22f340f660a180fcd16c95e425be
SSDEEP

96:mtHeXzmXi6StAClg/bwRvyvTrwCqiqOor:QeXanHCltvyAeor

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 4824	3628	NEAS.dcb7cccd0e5bee8b709d928b10482430.exe	99
PID 3628 wrote to memory of 4824	3628	NEAS.dcb7cccd0e5bee8b709d928b10482430.exe	99

C:\Users\Admin\AppData\Local\Temp\NEAS.dcb7cccd0e5bee8b709d928b10482430.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.dcb7cccd0e5bee8b709d928b10482430.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\20231104T075727_371.exe
  2⤵
  PID:4824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads