aff0f8ac7b053278fff741444214703e0b6d734f546a1572269612a69dc5bd0d

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 08:57

Target

NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe
Size

1.1MB
MD5

da1f0e239a5011af1c25d6ae7d2841a0
SHA1

496007341ee18e272b4254b4af4fa3b1fcb61157
SHA256

aff0f8ac7b053278fff741444214703e0b6d734f546a1572269612a69dc5bd0d
SHA512

5377ccb806f401fc5e0e8d261931825c5de721a206218876f40f8e43e0159c086b96d0835a5430854f2f5bc144040f0fb57cd49acbc302cfcda25a7f9ceb5a25
SSDEEP

24576:otEW9gH1dNmfEaWZ6YeIPjBMu837pT7uzLOY:ots1dNmfrLm83FT7uzLO

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2672 set thread context of 4304	2672	NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe	88

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 4304	2672	NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe	88
PID 2672 wrote to memory of 4304	2672	NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe	88
PID 2672 wrote to memory of 4304	2672	NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe	88
PID 2672 wrote to memory of 4304	2672	NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe	88
PID 2672 wrote to memory of 4304	2672	NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe	88
PID 2672 wrote to memory of 4304	2672	NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe	88
PID 2672 wrote to memory of 4304	2672	NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe	88
PID 2672 wrote to memory of 4304	2672	NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe	88
PID 2672 wrote to memory of 4304	2672	NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe	88
PID 2672 wrote to memory of 4304	2672	NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe	88

C:\Users\Admin\AppData\Local\Temp\NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.da1f0e239a5011af1c25d6ae7d2841a0_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4304

memory/4304-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4304-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4304-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4304-3-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4304-4-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download