6ccf8e067cd6f6a6ebfff7c5b18847075ee95f553d2746183ad5e9d116379f49

Analysis

max time kernel
38s
max time network
70s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:56

Target

NEOoks.exe
Size

6.2MB
MD5

f0dd5bdf749961a52acf5773a52e5c9c
SHA1

2d966720c26abfee2750996f4d8dd3ebe261b12a
SHA256

1e0fb5f6ea7f5fee49c0651b87b3a606862041419b267b534ef14ed00861a3ce
SHA512

e55827fba8580e9a87bf84ca172b03a279cca4956299e4b3799784cacc48e5634bbe5c5819669a4dbbb2bb630207e857647ba0d041d197c1bba19ca3cb5e2ba0
SSDEEP

98304:Jrv1p0SzksF8mIu8dAfqJidQWftLtiBA6Ex1/vVYy7fUJteABdDrdj:JN2SosFIifrnfhtI5EHayzwkABdDBj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1044 1776 WerFault.exe NEOoks.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

NEOoks.exe

pid process

1776 NEOoks.exe
1776 NEOoks.exe

pid	pid_target	process	target process
1044	1776	WerFault.exe	NEOoks.exe

pid	process
1776	NEOoks.exe
1776	NEOoks.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

NEOoks.exe

description	pid	process	target process
PID 1776 wrote to memory of 1044	1776	NEOoks.exe	WerFault.exe
PID 1776 wrote to memory of 1044	1776	NEOoks.exe	WerFault.exe
PID 1776 wrote to memory of 1044	1776	NEOoks.exe	WerFault.exe
PID 1776 wrote to memory of 1044	1776	NEOoks.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\NEOoks.exe
"C:\Users\Admin\AppData\Local\Temp\NEOoks.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 580
  2⤵
  - Program crash
  PID:1044

memory/1044-63-0x0000000000000000-mapping.dmp

Download
memory/1776-54-0x00000000029B0000-0x0000000002BF6000-memory.dmp

Filesize
2.3MB

Download
memory/1776-55-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1776-56-0x00000000029B0000-0x0000000002BF6000-memory.dmp

Filesize
2.3MB

Download
memory/1776-57-0x00000000029B0000-0x0000000002BF6000-memory.dmp

Filesize
2.3MB

Download
memory/1776-59-0x0000000000400000-0x000000000095F000-memory.dmp

Filesize
5.4MB

Download
memory/1776-60-0x00000000029B0000-0x0000000002BF6000-memory.dmp

Filesize
2.3MB

Download
memory/1776-61-0x0000000000400000-0x000000000095F000-memory.dmp

Filesize
5.4MB

Download
memory/1776-62-0x00000000029B0000-0x0000000002BF6000-memory.dmp

Filesize
2.3MB

Download