933f89ed4a9f40a4a961b6fab22a7627639c27f985fcc03d69f6fdecf65cdb07

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 19:09

Target

0a05e89acbc6bb551fdc6d8e8e5f7750_NEAS.exe
Size

653KB
MD5

0a05e89acbc6bb551fdc6d8e8e5f7750
SHA1

79ad377480187b481dc377a2e30ede8179d9b0a0
SHA256

933f89ed4a9f40a4a961b6fab22a7627639c27f985fcc03d69f6fdecf65cdb07
SHA512

155cf224e7d91dd628a0718ccd132c7cdcb44685c66d1289b4cc0fab5c2d3053c3f82d2e1dcb369651184da1eaeed37f01bc245ac6031f6a0343de9fed1e8bac
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+6:j7vmp8Rz1GJR8AB+Is9yvr7/jkD

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3028-1-0x000000013F2F0000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/3028-2-0x000000013F2F0000-0x000000013F712000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 840	3028	0a05e89acbc6bb551fdc6d8e8e5f7750_NEAS.exe	29
PID 3028 wrote to memory of 840	3028	0a05e89acbc6bb551fdc6d8e8e5f7750_NEAS.exe	29
PID 3028 wrote to memory of 840	3028	0a05e89acbc6bb551fdc6d8e8e5f7750_NEAS.exe	29

C:\Users\Admin\AppData\Local\Temp\0a05e89acbc6bb551fdc6d8e8e5f7750_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\0a05e89acbc6bb551fdc6d8e8e5f7750_NEAS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3028 -s 84
  2⤵
  PID:840

memory/3028-0-0x0000000000180000-0x00000000001A0000-memory.dmp

Filesize
128KB

Download
memory/3028-1-0x000000013F2F0000-0x000000013F712000-memory.dmp

Filesize
4.1MB

Download
memory/3028-2-0x000000013F2F0000-0x000000013F712000-memory.dmp

Filesize
4.1MB

Download