3681a9093529255ff1a1f321fd86d709d040a8a72160df5f6a0d6250ec9453fa

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05/11/2023, 23:49

Target

NEAS.07e058316338bb6ec321f9eada84d380.exe
Size

469KB
MD5

07e058316338bb6ec321f9eada84d380
SHA1

be43d2a4bbba5c44bc316c3ea3efdfbb63a53b7a
SHA256

3681a9093529255ff1a1f321fd86d709d040a8a72160df5f6a0d6250ec9453fa
SHA512

5551539f299441fb3001c0bc42a355819e210fed74336656796e24f88f72efe9f15f856875667324c97ee6cad70130abb88252eeea3ee39c87456bb59a6de87e
SSDEEP

6144:GTykDONo0jv7IoPfeq1ZzxRJbL7f5LAh3rESLL6U/h9//6f9mFSVoztR6/Gh0fAz:GLry/neyx7fDA6M8mFim76uKXddbNG

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2804	rrujhcvfcnbrm.exe

Loads dropped DLL 1 IoCs

pid	Process
2040	NEAS.07e058316338bb6ec321f9eada84d380.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\alandtaxza\rrujhcvfcnbrm.exe	NEAS.07e058316338bb6ec321f9eada84d380.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2804	2040	NEAS.07e058316338bb6ec321f9eada84d380.exe	28
PID 2040 wrote to memory of 2804	2040	NEAS.07e058316338bb6ec321f9eada84d380.exe	28
PID 2040 wrote to memory of 2804	2040	NEAS.07e058316338bb6ec321f9eada84d380.exe	28
PID 2040 wrote to memory of 2804	2040	NEAS.07e058316338bb6ec321f9eada84d380.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.07e058316338bb6ec321f9eada84d380.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.07e058316338bb6ec321f9eada84d380.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\alandtaxza\rrujhcvfcnbrm.exe
  "C:\Program Files (x86)\alandtaxza\rrujhcvfcnbrm.exe"
  2⤵
  - Executes dropped EXE
  PID:2804

C:\Program Files (x86)\alandtaxza\rrujhcvfcnbrm.exe

Filesize
482KB

MD5
38fdf8249d768ab022bf66acffd11259

SHA1
af76cf8bbf36cd5e1d45c445961151f1dcbcf824

SHA256
bac196aab0d9668d3d961c30303c4ef781e1f9c8f86f7b0126d00f369f872a27

SHA512
dc2a4ad6d183c02bc44171109c31244e370b3ba66d5c4e03a4bf0b8c49e673e520ee523c55f6e529fcdfe430e46de1c27c98c15dee4e33af3d2b38bb167f63f1

Download Submit
\Program Files (x86)\alandtaxza\rrujhcvfcnbrm.exe

Filesize
482KB

MD5
38fdf8249d768ab022bf66acffd11259

SHA1
af76cf8bbf36cd5e1d45c445961151f1dcbcf824

SHA256
bac196aab0d9668d3d961c30303c4ef781e1f9c8f86f7b0126d00f369f872a27

SHA512
dc2a4ad6d183c02bc44171109c31244e370b3ba66d5c4e03a4bf0b8c49e673e520ee523c55f6e529fcdfe430e46de1c27c98c15dee4e33af3d2b38bb167f63f1

Download Submit
memory/2040-0-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2040-1-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2040-7-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2804-9-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2804-10-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download