309535fb7d46f0a46450ab3adf1e3d0c564a7f3bebd66dce3a952023850f5b40

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 01:10

Target

NEAS.9ec8f85eaf5309ae4f643228c0aa6d10.exe
Size

1016KB
MD5

9ec8f85eaf5309ae4f643228c0aa6d10
SHA1

4e17e643645c9bbdd97923c96386dcbe97271fa9
SHA256

309535fb7d46f0a46450ab3adf1e3d0c564a7f3bebd66dce3a952023850f5b40
SHA512

e5e24f7b0501adc0dab945997ecfeada2f7e24e25aee9f2155b2d3c044213945ec333aee1f2994f07ec0e9111592cf552734469b2e90321fa207cde33ea11d2f
SSDEEP

24576:HnT3wqgdb+3mXuzu1VQ5zY4xTxpgdb+3mXuzu7VQ5zY4xh:HjwqZtYKpttYi

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1152	NEAS.9ec8f85eaf5309ae4f643228c0aa6d10.exe

Executes dropped EXE 1 IoCs

pid	Process
1152	NEAS.9ec8f85eaf5309ae4f643228c0aa6d10.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1512	4200	WerFault.exe	87
3116	1152	WerFault.exe	97
3768	1152	WerFault.exe	97

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4200	NEAS.9ec8f85eaf5309ae4f643228c0aa6d10.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 1152	4200	NEAS.9ec8f85eaf5309ae4f643228c0aa6d10.exe	97
PID 4200 wrote to memory of 1152	4200	NEAS.9ec8f85eaf5309ae4f643228c0aa6d10.exe	97
PID 4200 wrote to memory of 1152	4200	NEAS.9ec8f85eaf5309ae4f643228c0aa6d10.exe	97

C:\Users\Admin\AppData\Local\Temp\NEAS.9ec8f85eaf5309ae4f643228c0aa6d10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9ec8f85eaf5309ae4f643228c0aa6d10.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 396
  2⤵
  - Program crash
  PID:1512
- C:\Users\Admin\AppData\Local\Temp\NEAS.9ec8f85eaf5309ae4f643228c0aa6d10.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.9ec8f85eaf5309ae4f643228c0aa6d10.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 364
    3⤵
    - Program crash
    PID:3116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 368
    3⤵
    - Program crash
    PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4200 -ip 4200
1⤵
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1152 -ip 1152
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1152 -ip 1152
1⤵
PID:1440

C:\Users\Admin\AppData\Local\Temp\NEAS.9ec8f85eaf5309ae4f643228c0aa6d10.exe

Filesize
1016KB

MD5
9fc255d214370fa742f9ac3fb17399fb

SHA1
99cf435198c05ce978468d4288151f6d3c0419ec

SHA256
41fa4f61596d6dd5bd0f3064c1384d102a0245ceed5576063572bb0d59847f07

SHA512
5edaded3f3dcb8de4c81d9e9a038058c09ba9e9f6e380775e65c95ff897fac823d32e6e1ba44448241880e033d807b0ae681a5dfff1b80b9e306a03aa442974a

Download Submit
memory/1152-7-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1152-10-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4200-0-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/4200-8-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download