a969f77fee40e5a29ecbae36b13c014c0158bf8758965f6cd9d63a8b66964958

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
05/11/2023, 06:37

Target

NEAS.cfa248a6c97635b3e630554022d9ba60_JC.exe
Size

5KB
MD5

cfa248a6c97635b3e630554022d9ba60
SHA1

ee6d317eb61bb9d3b72796824df1c75d970098a4
SHA256

a969f77fee40e5a29ecbae36b13c014c0158bf8758965f6cd9d63a8b66964958
SHA512

e923c80a12f889e37bcb477c517ab8ffd0d2885ca6cf76bc5868b00201fba9ab9bec6b2217d235c56d65a1591663511f10ac275ca63513fd2cafd899d4e9e26e
SSDEEP

48:6zJtHvIWXbOXUPGIjVhURWA9oqTDkzuO/znONQnddoTrg7LYxYn31p199orwoHG:ktHvdXbtGIxV1bnOmnddoTrXxS3zhor

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2644	2808	NEAS.cfa248a6c97635b3e630554022d9ba60_JC.exe	30
PID 2808 wrote to memory of 2644	2808	NEAS.cfa248a6c97635b3e630554022d9ba60_JC.exe	30
PID 2808 wrote to memory of 2644	2808	NEAS.cfa248a6c97635b3e630554022d9ba60_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.cfa248a6c97635b3e630554022d9ba60_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cfa248a6c97635b3e630554022d9ba60_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\20231105T063802_595.exe
  2⤵
  PID:2644