2d62dd5d5a76d34fe015d8f8c3a368f27e66122c7a5648c01c98e78fd2cec616

Analysis

max time kernel
133s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
12/11/2023, 22:38

Target

NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe
Size

189KB
MD5

4df0c17d95dcd3b06d2b6c3125bd5480
SHA1

ca01cac80b5b01e41875cd49ed09e65ec759b126
SHA256

2d62dd5d5a76d34fe015d8f8c3a368f27e66122c7a5648c01c98e78fd2cec616
SHA512

807781313b9862fab50f4999b41237d111cdaaafd272344b3af23557267f4377c322ca3155ee149eae154c3072452624ea87eeeee47d54a5396f19adfa26309d
SSDEEP

3072:RYG/aOpxe/FC7MqzID1xt1lDZaGUC19DFjh2JptWhCw3BDR:KnKyC7MBn6sZh4bQ53BDR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1332	NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe

Executes dropped EXE 1 IoCs

pid	Process
1332	NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1340	4872	WerFault.exe	86
2704	1332	WerFault.exe	96
4088	1332	WerFault.exe	96
5064	1332	WerFault.exe	96
3472	1332	WerFault.exe	96

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4872	NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1332	NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 1332	4872	NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe	96
PID 4872 wrote to memory of 1332	4872	NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe	96
PID 4872 wrote to memory of 1332	4872	NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe	96

C:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 384
  2⤵
  - Program crash
  PID:1340
- C:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 352
    3⤵
    - Program crash
    PID:2704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 768
    3⤵
    - Program crash
    PID:4088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 788
    3⤵
    - Program crash
    PID:5064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 772
    3⤵
    - Program crash
    PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4872 -ip 4872
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1332 -ip 1332
1⤵
PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1332 -ip 1332
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1332 -ip 1332
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1332 -ip 1332
1⤵
PID:3840

C:\Users\Admin\AppData\Local\Temp\NEAS.4df0c17d95dcd3b06d2b6c3125bd5480.exe

Filesize
189KB

MD5
f11ac4235d514af480919b559ae03b29

SHA1
efa3ba3f6ffea38fbafc764ac64ab110b6d4dc21

SHA256
115f6aec674b55b379d8f52cd02b56f512ca3f569899a31cbc57a132c7e86a3f

SHA512
3094a8e7fb260da84da5c571cad6ea7f8a3f37a909ff10da7e66e6a33cafd7647874a8521fa5d8426461d8591aadef0938611e9f48662cae6e9dd3550f6b2be8

Download Submit
memory/1332-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1332-8-0x00000000014D0000-0x000000000150C000-memory.dmp

Filesize
240KB

Download
memory/1332-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4872-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4872-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download