e4fe171bee305ddad87e068401122e004109eb87d6eee44d4402f5211699da92

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2023 23:33

Target

NEAS.667bfd1c075052b12bef430d6abc8920.exe
Size

199KB
MD5

667bfd1c075052b12bef430d6abc8920
SHA1

e6dde05da85c31c338468a0040d33fbe07d67817
SHA256

e4fe171bee305ddad87e068401122e004109eb87d6eee44d4402f5211699da92
SHA512

93ccf1f8b20e6a1f3e1b63148d69a036d089a614534e862164b16f372b51d47e9f31571b8bfb433504a15d257c6427d863a8519db2d32253eac0169e6fc6af21
SSDEEP

6144:6P+aqO4Kx5YOWHtsWVqgh8DyL0jRXnMseq2aVdU736uEOym5bc/pLOFgsvQzW:CeXg9Oj5dc2vIy

Score

7^/10

upx

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdater.exe	NEAS.667bfd1c075052b12bef430d6abc8920.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdater.exe	NEAS.667bfd1c075052b12bef430d6abc8920.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4552-0-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral2/memory/4552-10-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4552 set thread context of 1628	4552	NEAS.667bfd1c075052b12bef430d6abc8920.exe	88

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4552	NEAS.667bfd1c075052b12bef430d6abc8920.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 1628	4552	NEAS.667bfd1c075052b12bef430d6abc8920.exe	88
PID 4552 wrote to memory of 1628	4552	NEAS.667bfd1c075052b12bef430d6abc8920.exe	88
PID 4552 wrote to memory of 1628	4552	NEAS.667bfd1c075052b12bef430d6abc8920.exe	88
PID 4552 wrote to memory of 1628	4552	NEAS.667bfd1c075052b12bef430d6abc8920.exe	88
PID 4552 wrote to memory of 1628	4552	NEAS.667bfd1c075052b12bef430d6abc8920.exe	88
PID 4552 wrote to memory of 1628	4552	NEAS.667bfd1c075052b12bef430d6abc8920.exe	88
PID 4552 wrote to memory of 1628	4552	NEAS.667bfd1c075052b12bef430d6abc8920.exe	88

C:\Users\Admin\AppData\Local\Temp\NEAS.667bfd1c075052b12bef430d6abc8920.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.667bfd1c075052b12bef430d6abc8920.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Users\Admin\AppData\Local\Temp\NEAS.667bfd1c075052b12bef430d6abc8920.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.667bfd1c075052b12bef430d6abc8920.exe
  2⤵
  PID:1628

memory/1628-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1628-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1628-7-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1628-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1628-11-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1628-13-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1628-14-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/4552-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4552-10-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download