3d58022500366936352218f42dc84b417c083f2c4c968f324245273975ea3ecf

Analysis

max time kernel
147s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 17:59

Target

9120591759d5c9a629a5f225d9e63360_NEAS.exe
Size

768KB
MD5

9120591759d5c9a629a5f225d9e63360
SHA1

3c81f1336bf0eb6d25b10ce7bf233b56da28c6a7
SHA256

3d58022500366936352218f42dc84b417c083f2c4c968f324245273975ea3ecf
SHA512

d7a9bcc979bd6ffe2bb9f4831bc84fbf2c1ba82acc9eaf68f6527540949b201a542a311f013d5a5d445e33069485202f07caf35741fbfd614ea9923ca2a7d926
SSDEEP

12288:iw22cpj1xw7j0npM4dl0v5Jdm5IgVQBHzS+iYf8MWcqxgJj5v37QgzdrIVOmkV08:122c9w7jEM4dmv5BTqV0EM42

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1576	9120591759d5c9a629a5f225d9e63360_NEAS.exe

Executes dropped EXE 1 IoCs

pid	Process
1576	9120591759d5c9a629a5f225d9e63360_NEAS.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2560	752	WerFault.exe	84
1044	1576	WerFault.exe	91
1692	1576	WerFault.exe	91
3504	1576	WerFault.exe	91
1156	1576	WerFault.exe	91
3648	1576	WerFault.exe	91
4528	1576	WerFault.exe	91

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
752	9120591759d5c9a629a5f225d9e63360_NEAS.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1576	9120591759d5c9a629a5f225d9e63360_NEAS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1576	752	9120591759d5c9a629a5f225d9e63360_NEAS.exe	91
PID 752 wrote to memory of 1576	752	9120591759d5c9a629a5f225d9e63360_NEAS.exe	91
PID 752 wrote to memory of 1576	752	9120591759d5c9a629a5f225d9e63360_NEAS.exe	91

C:\Users\Admin\AppData\Local\Temp\9120591759d5c9a629a5f225d9e63360_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\9120591759d5c9a629a5f225d9e63360_NEAS.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 384
  2⤵
  - Program crash
  PID:2560
- C:\Users\Admin\AppData\Local\Temp\9120591759d5c9a629a5f225d9e63360_NEAS.exe
  C:\Users\Admin\AppData\Local\Temp\9120591759d5c9a629a5f225d9e63360_NEAS.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 352
    3⤵
    - Program crash
    PID:1044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 768
    3⤵
    - Program crash
    PID:1692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 808
    3⤵
    - Program crash
    PID:3504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 828
    3⤵
    - Program crash
    PID:1156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 836
    3⤵
    - Program crash
    PID:3648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 820
    3⤵
    - Program crash
    PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 752 -ip 752
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1576 -ip 1576
1⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1576 -ip 1576
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1576 -ip 1576
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1576 -ip 1576
1⤵
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1576 -ip 1576
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1576 -ip 1576
1⤵
PID:3428

C:\Users\Admin\AppData\Local\Temp\9120591759d5c9a629a5f225d9e63360_NEAS.exe

Filesize
768KB

MD5
7ac9fa7a61e042d6d17eb1133371c522

SHA1
e9c1f6c15aa3f02a29e285db9b12e9818ad3a6e6

SHA256
8f292e0281c6964be9526778bd434b632bd84ecada6bfd2560bfc7e9528c5d8f

SHA512
830f29629b81d4e253528be0556e3d5dcf3a23a2fdd033d7e6fa8ca513810c503a0918fba15597ef14a063ff0e543bb1af9ecc23aeebb4bf4cd1325993cdeabf

Download Submit
memory/752-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/752-5-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1576-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1576-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1576-13-0x00000000014D0000-0x0000000001511000-memory.dmp

Filesize
260KB

Download