820b52082f89fba7d366964c6a59cd92ed2edb7dcd971ab65239973a7f1a9525

Analysis

max time kernel
134s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 10:44

Target

473767df05eba5fecb0a951869220b30_NEAS.exe
Size

79KB
MD5

473767df05eba5fecb0a951869220b30
SHA1

6b3fb8494e95f925776f809dda7cb32477b7cdb4
SHA256

820b52082f89fba7d366964c6a59cd92ed2edb7dcd971ab65239973a7f1a9525
SHA512

1a672896bc9bc1920dc8220d2bcda3b7f6ac1f42acdb8ffe50014ac4b075f1d1bd7721dd5e155cb49f95728e000aa532fa8ab45b420c90f07aedbf9578fc21c5
SSDEEP

1536:zvfgmvxviO49KlQ5OQA8AkqUhMb2nuy5wgIP0CSJ+5yYB8GMGlZ5G:zvfp9iOAKlLGdqU7uy5w9WMyYN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2120	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 1308	4380	473767df05eba5fecb0a951869220b30_NEAS.exe	85
PID 4380 wrote to memory of 1308	4380	473767df05eba5fecb0a951869220b30_NEAS.exe	85
PID 4380 wrote to memory of 1308	4380	473767df05eba5fecb0a951869220b30_NEAS.exe	85
PID 1308 wrote to memory of 2120	1308	cmd.exe	86
PID 1308 wrote to memory of 2120	1308	cmd.exe	86
PID 1308 wrote to memory of 2120	1308	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\473767df05eba5fecb0a951869220b30_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\473767df05eba5fecb0a951869220b30_NEAS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2120

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
bdd3ab6b903978b82f1c74f40fa23f65

SHA1
3e6291f1092f7308b4967ec21d56213725219b6e

SHA256
b7aad7040372b6a48439a284411507bc42a6029c37ece4636a7642db6359f13a

SHA512
d8d79dc1b70d2ac9fbb4d0e6c1852a3b850819efb25253d84933ae13e3507344c84eb41c82f0b0206ebf419d2021bfebb3c5fd5e3d44a73cf561f310cd9497f0

Download Submit
memory/2120-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4380-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download