5c634f2dfef2dddf65c8aa43b2f719bfe2716941e31240584a1edf3654c34798

Analysis

max time kernel
86s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2023, 07:26

Target

NEAS.cdb8e1e3f858beae8d95f6767b25cbc0.exe
Size

1.0MB
MD5

cdb8e1e3f858beae8d95f6767b25cbc0
SHA1

a81c376b3488ff4e13d8bb4b6a352eaa8e8c98b3
SHA256

5c634f2dfef2dddf65c8aa43b2f719bfe2716941e31240584a1edf3654c34798
SHA512

9f56c2b23191b6281a7da082f221317ad599cf438839e9f2a6df1a3e1273708ee8ef1ab97589090bbb52086c715d7907582059a54fcfb78330980664ac946a5b
SSDEEP

24576:hZ5u8PemjFr0eVwnpOa1yskI4k69e+X6nZd3TiSFrl/N65mBmFK:vxhJ0eWn4so9D6n3P5vwK

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3068	rfvknieuapg.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\tgpeaeuxy\rfvknieuapg.exe	NEAS.cdb8e1e3f858beae8d95f6767b25cbc0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 3068	868	NEAS.cdb8e1e3f858beae8d95f6767b25cbc0.exe	90
PID 868 wrote to memory of 3068	868	NEAS.cdb8e1e3f858beae8d95f6767b25cbc0.exe	90
PID 868 wrote to memory of 3068	868	NEAS.cdb8e1e3f858beae8d95f6767b25cbc0.exe	90

C:\Users\Admin\AppData\Local\Temp\NEAS.cdb8e1e3f858beae8d95f6767b25cbc0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cdb8e1e3f858beae8d95f6767b25cbc0.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:868
- C:\Program Files (x86)\tgpeaeuxy\rfvknieuapg.exe
  "C:\Program Files (x86)\tgpeaeuxy\rfvknieuapg.exe"
  2⤵
  - Executes dropped EXE
  PID:3068

C:\Program Files (x86)\tgpeaeuxy\rfvknieuapg.exe

Filesize
1.1MB

MD5
9f9ba4a7b0c3e0a3a1d57d5c995708fd

SHA1
cadae4cf132833d1a88f9747414f628e132a2b45

SHA256
057642282a88f88cc760f682927208c316552cf4d00421c8aed6aafa980c479a

SHA512
a396a182d90d15d03a61a2ee030dbaee019557de49d9532e2f91686c2abecac1b7b0eeb0e44789371971c3791b35f3059e0f5769dbce3e3eebb44cdc85668c0a

Download Submit
C:\Program Files (x86)\tgpeaeuxy\rfvknieuapg.exe

Filesize
1.1MB

MD5
9f9ba4a7b0c3e0a3a1d57d5c995708fd

SHA1
cadae4cf132833d1a88f9747414f628e132a2b45

SHA256
057642282a88f88cc760f682927208c316552cf4d00421c8aed6aafa980c479a

SHA512
a396a182d90d15d03a61a2ee030dbaee019557de49d9532e2f91686c2abecac1b7b0eeb0e44789371971c3791b35f3059e0f5769dbce3e3eebb44cdc85668c0a

Download Submit
memory/868-0-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/868-1-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/868-6-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-7-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-8-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download