6d8b8dc8c8097bb3f12e692c86998af1f4b16195f2053767702b95eca83d355a

Analysis

max time kernel
128s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 05:08

Target

6e0a4d5843378489a70d0d6c9335ca30_NEAS.exe
Size

218KB
MD5

6e0a4d5843378489a70d0d6c9335ca30
SHA1

ba409b596bac328268219674dd34583b2effbd7b
SHA256

6d8b8dc8c8097bb3f12e692c86998af1f4b16195f2053767702b95eca83d355a
SHA512

b3df89c065912c14d90a744a6f951d39df9f717b92e168943ff1151a5983d2da139a57214aa7c5df14fac10a49216517790fe135465c4902699171b90fb60f54
SSDEEP

6144:z78/4zGc07144DmkBjyhxQEab4pKX9aLisM+Nea:z7cqR07144Dm2+zQE3pKX9aLisvNea

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2760	6e0a4d5843378489a70d0d6c9335ca30_NEAS.exe

Executes dropped EXE 1 IoCs

pid	Process
2760	6e0a4d5843378489a70d0d6c9335ca30_NEAS.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1756	3184	WerFault.exe	84
3720	2760	WerFault.exe	90

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3184	6e0a4d5843378489a70d0d6c9335ca30_NEAS.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2760	6e0a4d5843378489a70d0d6c9335ca30_NEAS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 2760	3184	6e0a4d5843378489a70d0d6c9335ca30_NEAS.exe	90
PID 3184 wrote to memory of 2760	3184	6e0a4d5843378489a70d0d6c9335ca30_NEAS.exe	90
PID 3184 wrote to memory of 2760	3184	6e0a4d5843378489a70d0d6c9335ca30_NEAS.exe	90

C:\Users\Admin\AppData\Local\Temp\6e0a4d5843378489a70d0d6c9335ca30_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\6e0a4d5843378489a70d0d6c9335ca30_NEAS.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 396
  2⤵
  - Program crash
  PID:1756
- C:\Users\Admin\AppData\Local\Temp\6e0a4d5843378489a70d0d6c9335ca30_NEAS.exe
  C:\Users\Admin\AppData\Local\Temp\6e0a4d5843378489a70d0d6c9335ca30_NEAS.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 364
    3⤵
    - Program crash
    PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3184 -ip 3184
1⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2760 -ip 2760
1⤵
PID:3024

C:\Users\Admin\AppData\Local\Temp\6e0a4d5843378489a70d0d6c9335ca30_NEAS.exe

Filesize
218KB

MD5
0e0639a6d374344376726cb7fdf81a6b

SHA1
3b7ccaa2dcdfd9520fd9db15243679698de908b5

SHA256
7685afb6ea8b9a880109776951dc92834bb7c4ce50716fd427e4e3cd4213cf41

SHA512
14d4e10535b552a32aefa031d97cece94311510b761bcf44e55093056a2e04073f7ff4f66d7fcaf202e933c6f93dd047e9c55990a207817d50a3f2c732323d24

Download Submit
memory/2760-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2760-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2760-13-0x0000000001660000-0x00000000016A2000-memory.dmp

Filesize
264KB

Download
memory/3184-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3184-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download