9496ec23a33b546888ae5cfd2dfa0460aba9d32b225ecb5159c25564a22633b3

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 01:14

Target

NEAS.a10b99f3098986f1c7fab84ab000d5c0.exe
Size

200KB
MD5

a10b99f3098986f1c7fab84ab000d5c0
SHA1

3fe10ad2e426e38e0231d856e2ce864d8988bb5c
SHA256

9496ec23a33b546888ae5cfd2dfa0460aba9d32b225ecb5159c25564a22633b3
SHA512

89719c81923fc15c9629ed76108bb3dbc274525662c295fd9eedc8140769a39200156dec11e3dd5867f4f12ab90076d25cc2054704676173465f168c9621b668
SSDEEP

3072:xpML+sLi9YCM3Ji+nx/x7yuOW6zDXxhktTBsYzQzaMuEPguUYGXgUB7u:DmVO965i+nxZ7yuOl0tTKPXuZudG1B7u

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3988	NEAS.a10b99f3098986f1c7fab84ab000d5c0.exe

Executes dropped EXE 1 IoCs

pid	Process
3988	NEAS.a10b99f3098986f1c7fab84ab000d5c0.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1692	3096	WerFault.exe	83
880	3988	WerFault.exe	91

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3096	NEAS.a10b99f3098986f1c7fab84ab000d5c0.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3988	NEAS.a10b99f3098986f1c7fab84ab000d5c0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 3988	3096	NEAS.a10b99f3098986f1c7fab84ab000d5c0.exe	91
PID 3096 wrote to memory of 3988	3096	NEAS.a10b99f3098986f1c7fab84ab000d5c0.exe	91
PID 3096 wrote to memory of 3988	3096	NEAS.a10b99f3098986f1c7fab84ab000d5c0.exe	91

C:\Users\Admin\AppData\Local\Temp\NEAS.a10b99f3098986f1c7fab84ab000d5c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.a10b99f3098986f1c7fab84ab000d5c0.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 396
  2⤵
  - Program crash
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\NEAS.a10b99f3098986f1c7fab84ab000d5c0.exe
  C:\Users\Admin\AppData\Local\Temp\NEAS.a10b99f3098986f1c7fab84ab000d5c0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 372
    3⤵
    - Program crash
    PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3096 -ip 3096
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3988 -ip 3988
1⤵
PID:3084

C:\Users\Admin\AppData\Local\Temp\NEAS.a10b99f3098986f1c7fab84ab000d5c0.exe

Filesize
200KB

MD5
ddac479c7933870fee1d768e3a956cfc

SHA1
774e39934a67e10912209d674a2ce869d66891fa

SHA256
c1bd4898bda6c28900964ece3fbb5b88b54c385f57d389c09e3934addd230f23

SHA512
0e62088e9dd56e40159156fadf9001a3937be695ef9aec61ba62a5f31c32c4e2764b6cadb363f78db2d95d2ad867c30dcb3dd97dd5d02c181ced133d2dda8e63

Download Submit
memory/3096-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3096-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3988-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3988-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3988-10-0x00000000015E0000-0x000000000161F000-memory.dmp

Filesize
252KB

Download