af76869e48059cd348cc71a933cccbba189897de7d0ad872346c15d40fefc2c6

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05-11-2023 18:38

Target

NEAS.b2a69ac9e9d79972106b4da779c01610_JC.exe
Size

406KB
MD5

b2a69ac9e9d79972106b4da779c01610
SHA1

03d08687f1c850f93ac3eb76be3f6269fab03dc7
SHA256

af76869e48059cd348cc71a933cccbba189897de7d0ad872346c15d40fefc2c6
SHA512

d61d29332415b23ad132fc7ea78672b4133da070a97f44280aa0f3b6a2e5edd9d74f96467f6ed89566fa794cb32bf9d61acfb52249001314badda857be64192a
SSDEEP

6144:GTykDONo0jv7IoPfeq1ZzxRJbL7f5LAh3rESLL6/L7pTjDcNzbahP7L72ekT:GLry/neyx7fDA6j7pT/4bEPH7tkT

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3008	gatsojy.exe

Loads dropped DLL 1 IoCs

pid	Process
2720	NEAS.b2a69ac9e9d79972106b4da779c01610_JC.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\sokxgxnjva\gatsojy.exe	NEAS.b2a69ac9e9d79972106b4da779c01610_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3008	2720	NEAS.b2a69ac9e9d79972106b4da779c01610_JC.exe	28
PID 2720 wrote to memory of 3008	2720	NEAS.b2a69ac9e9d79972106b4da779c01610_JC.exe	28
PID 2720 wrote to memory of 3008	2720	NEAS.b2a69ac9e9d79972106b4da779c01610_JC.exe	28
PID 2720 wrote to memory of 3008	2720	NEAS.b2a69ac9e9d79972106b4da779c01610_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.b2a69ac9e9d79972106b4da779c01610_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b2a69ac9e9d79972106b4da779c01610_JC.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\sokxgxnjva\gatsojy.exe
  "C:\Program Files (x86)\sokxgxnjva\gatsojy.exe"
  2⤵
  - Executes dropped EXE
  PID:3008

C:\Program Files (x86)\sokxgxnjva\gatsojy.exe

Filesize
427KB

MD5
a3887f762d3fc9a66085656451acd84d

SHA1
d72f170ef0e19ecb08d429c90d38150554414449

SHA256
facec1b3dd131c39f4a635368c63151a365d75f15b04e07f4fcfb985c61b1821

SHA512
02031865f29be9ac84e2f6a68df522a7f3cc078d7042c0f9c2abaceddd271cc8c0e6dff49268cfb6e3aa57784a963eabb55df6d5146ba4854d045ff99d719513

Download Submit
\Program Files (x86)\sokxgxnjva\gatsojy.exe

Filesize
427KB

MD5
a3887f762d3fc9a66085656451acd84d

SHA1
d72f170ef0e19ecb08d429c90d38150554414449

SHA256
facec1b3dd131c39f4a635368c63151a365d75f15b04e07f4fcfb985c61b1821

SHA512
02031865f29be9ac84e2f6a68df522a7f3cc078d7042c0f9c2abaceddd271cc8c0e6dff49268cfb6e3aa57784a963eabb55df6d5146ba4854d045ff99d719513

Download Submit
memory/2720-0-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2720-1-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2720-6-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2720-9-0x0000000000230000-0x00000000002C5000-memory.dmp

Filesize
596KB

Download
memory/3008-11-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3008-10-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3008-8-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download