effa7b6ac28c17f0ebcb61893217627c8596c2da9ac9af751cfb21bd75e0d8cf

Analysis

max time kernel
147s
max time network
155s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 10:37

Target

NEAS.0057cb0e953a9225350426ee0755b790_JC.exe
Size

128KB
MD5

0057cb0e953a9225350426ee0755b790
SHA1

5746da3c448622bd6938600086eeb125d592af4b
SHA256

effa7b6ac28c17f0ebcb61893217627c8596c2da9ac9af751cfb21bd75e0d8cf
SHA512

42399321e51872a394378e07ef38d3bb06a59cfa7e100287bfd9b07282cc1f298bb41926afc6f683bc06c18af804f17d10d5d9825c65fe0e64e43986183eb8db
SSDEEP

3072:rwgRDhNuDrK1b9wRRUUaSiHgSskGjCU5Z:rjjuDrOYRpiHgSske5Z

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2744 set thread context of 2348	2744	NEAS.0057cb0e953a9225350426ee0755b790_JC.exe	28

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2744	NEAS.0057cb0e953a9225350426ee0755b790_JC.exe
2744	NEAS.0057cb0e953a9225350426ee0755b790_JC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2348	2744	NEAS.0057cb0e953a9225350426ee0755b790_JC.exe	28
PID 2744 wrote to memory of 2348	2744	NEAS.0057cb0e953a9225350426ee0755b790_JC.exe	28
PID 2744 wrote to memory of 2348	2744	NEAS.0057cb0e953a9225350426ee0755b790_JC.exe	28
PID 2744 wrote to memory of 2348	2744	NEAS.0057cb0e953a9225350426ee0755b790_JC.exe	28
PID 2744 wrote to memory of 2348	2744	NEAS.0057cb0e953a9225350426ee0755b790_JC.exe	28
PID 2744 wrote to memory of 2348	2744	NEAS.0057cb0e953a9225350426ee0755b790_JC.exe	28
PID 2744 wrote to memory of 2348	2744	NEAS.0057cb0e953a9225350426ee0755b790_JC.exe	28
PID 2744 wrote to memory of 2348	2744	NEAS.0057cb0e953a9225350426ee0755b790_JC.exe	28
PID 2744 wrote to memory of 2348	2744	NEAS.0057cb0e953a9225350426ee0755b790_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.0057cb0e953a9225350426ee0755b790_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0057cb0e953a9225350426ee0755b790_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\NEAS.0057cb0e953a9225350426ee0755b790_JC.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.0057cb0e953a9225350426ee0755b790_JC.exe
  2⤵
  PID:2348

memory/2348-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2348-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2348-5-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2348-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2348-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2348-11-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2348-13-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2348-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2744-0-0x00000000001F0000-0x00000000001F4000-memory.dmp

Filesize
16KB

Download