d2f9183896047e542efa15d57dfe9de05c381d124c0c7c0818c2e89f50150acf

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 20:22

Target

NEAS.4984fdbdd6245e1f988658e95b4f0390.exe
Size

407KB
MD5

4984fdbdd6245e1f988658e95b4f0390
SHA1

c4fdd6e3326fbab6b251cc76c105b6808fc06e2f
SHA256

d2f9183896047e542efa15d57dfe9de05c381d124c0c7c0818c2e89f50150acf
SHA512

9d7c4142e4347babc7c44228a186beb8fb83db95472cdb796aefa54c84a937ede3f64fdc67d2ace7222ffe83b235ee6f7cb0114629640ae1ffdb48f86a4a031c
SSDEEP

6144:QmaI4Fq7Vw62SbJiPIrgNFLxdeuAONlvn1I6LMAXYaURWxCkIxs28HTmafOEvZEu:xavFq7y62RtflqnAyRe+xsZHO8wM

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2820 set thread context of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2772	2820	WerFault.exe	27

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 1636	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	29
PID 2820 wrote to memory of 2772	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	30
PID 2820 wrote to memory of 2772	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	30
PID 2820 wrote to memory of 2772	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	30
PID 2820 wrote to memory of 2772	2820	NEAS.4984fdbdd6245e1f988658e95b4f0390.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.4984fdbdd6245e1f988658e95b4f0390.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4984fdbdd6245e1f988658e95b4f0390.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 52
  2⤵
  - Program crash
  PID:2772

memory/1636-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-9-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1636-10-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-12-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download