2ce2a888e854909a6a00196d5d05f44c11028608f7fbd2a9ef4ca47c8e79ab99

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2023 05:13

Target

NEAS.0edea2038d8afe82ce544bb21ea35380.exe
Size

1.9MB
MD5

0edea2038d8afe82ce544bb21ea35380
SHA1

c1bf7a8684af3c51c5bc6e5c976f45d43f8e3962
SHA256

2ce2a888e854909a6a00196d5d05f44c11028608f7fbd2a9ef4ca47c8e79ab99
SHA512

5edc6edda183e4b2d6afa97927f8c14f72220faabe92afb0ebc09b80e5a62f19c96b92973391d4e811c29cf47508be776ea5f5cbeda1c268487c7c4087d7ad52
SSDEEP

49152:Qoa1taC070dKL3WI6PP0lx9/+bR1LtKKmLuVbgls:Qoa1taC0j3X6H0V/aR1LtKFLu5gls

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1784	B69E.tmp

Executes dropped EXE 1 IoCs

pid	Process
1784	B69E.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1784	3404	NEAS.0edea2038d8afe82ce544bb21ea35380.exe	89
PID 3404 wrote to memory of 1784	3404	NEAS.0edea2038d8afe82ce544bb21ea35380.exe	89
PID 3404 wrote to memory of 1784	3404	NEAS.0edea2038d8afe82ce544bb21ea35380.exe	89

C:\Users\Admin\AppData\Local\Temp\NEAS.0edea2038d8afe82ce544bb21ea35380.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0edea2038d8afe82ce544bb21ea35380.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Users\Admin\AppData\Local\Temp\B69E.tmp
  "C:\Users\Admin\AppData\Local\Temp\B69E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\NEAS.0edea2038d8afe82ce544bb21ea35380.exe BFE1DE45DB9926A93E22DCB7B13BC2EF470F937B6B47543571E672F630128CE401284D3696870D1844B5AB2A4EF621C672542B5C56F5A72F523AF47E3BC0AEA0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1784

C:\Users\Admin\AppData\Local\Temp\B69E.tmp

Filesize
1.9MB

MD5
0b76f32ab0dcc2afe0822f06997a7ee5

SHA1
85ce2a8a18ded2455bbf46531d5d143851a2cb60

SHA256
3f5ea981b69f02c80f41eb4ed6c6622eb30cd053e6047ee005ef0b5932a7988a

SHA512
48a4581fb43f353af422f45c6212e8be3e72520ce895ef703825edaf87cecbcca6f7f3adff86a91f4980bd9956fde1b1bcb403723714a86445be22dc9780f2d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\B69E.tmp

Filesize
1.9MB

MD5
0b76f32ab0dcc2afe0822f06997a7ee5

SHA1
85ce2a8a18ded2455bbf46531d5d143851a2cb60

SHA256
3f5ea981b69f02c80f41eb4ed6c6622eb30cd053e6047ee005ef0b5932a7988a

SHA512
48a4581fb43f353af422f45c6212e8be3e72520ce895ef703825edaf87cecbcca6f7f3adff86a91f4980bd9956fde1b1bcb403723714a86445be22dc9780f2d7

Download Submit
memory/1784-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download
memory/3404-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Filesize
1.9MB

Download