5cd90bde88be66d5ba26b82d8d80ec35ada9b9087a4d06daeef4b63718a0c514

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 06:48

Target

870e4818cf1981219bb2ec81231880d0_NEAS.exe
Size

6.0MB
MD5

870e4818cf1981219bb2ec81231880d0
SHA1

8aa88b2174405eb407eca6a6ffc01a293f1a62e1
SHA256

5cd90bde88be66d5ba26b82d8d80ec35ada9b9087a4d06daeef4b63718a0c514
SHA512

47d3c12685cc660cb01198f880564d5b80fa01b318b062450d3101cc777ae24c6c1f40271c77a8b29835eb22c676796d6e3eeab7babb2e0d6593631e3436c813
SSDEEP

98304:emhd1UryesvW33vd2V7wQqZUha5jtSyZIUS:elz342QbaZtlir

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3568	42E5.tmp

Executes dropped EXE 1 IoCs

pid	Process
3568	42E5.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 3568	2660	870e4818cf1981219bb2ec81231880d0_NEAS.exe	86
PID 2660 wrote to memory of 3568	2660	870e4818cf1981219bb2ec81231880d0_NEAS.exe	86
PID 2660 wrote to memory of 3568	2660	870e4818cf1981219bb2ec81231880d0_NEAS.exe	86

C:\Users\Admin\AppData\Local\Temp\870e4818cf1981219bb2ec81231880d0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\870e4818cf1981219bb2ec81231880d0_NEAS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\42E5.tmp
  "C:\Users\Admin\AppData\Local\Temp\42E5.tmp" --splashC:\Users\Admin\AppData\Local\Temp\870e4818cf1981219bb2ec81231880d0_NEAS.exe 3FD18D1E36AE1943250F531B1C000A030AFE52E6C6C10484793FA418832ED62A461F59B7BA05AD61A96794DBE1353E2819D5343FDE13B8628EFFB4763FFC634D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3568

C:\Users\Admin\AppData\Local\Temp\42E5.tmp

Filesize
6.0MB

MD5
c868cfa29cd3c1f9be102b625b31e240

SHA1
6a8d3870e2b7c287cb464fdae4e098a8676f15e7

SHA256
5e07714861a5c06f7a48f0a04054d33e3ef95c99e9dce8306a72ee3911b3b3a7

SHA512
8d7b3fbf7a246dbc318204919f284d5f6c1c6b21f700e62ad7ea9bdacfba03d75ecdfb6f21b41e5ffa6d4f51e1e97ea607debeb9f9fa5012e448fb53d783ff76

Download Submit
memory/2660-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/3568-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download