1dd6e1e33e969328f81eb6b46b270514392252b0bb00768925dfa5208b6e7488

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 20:23

Target

NEAS.554c6ec51c7c1ed963215a1ebc33a2a0.exe
Size

58KB
MD5

554c6ec51c7c1ed963215a1ebc33a2a0
SHA1

0ea29d9c83e9bd2bf3561f8e7cab3750d9f486f5
SHA256

1dd6e1e33e969328f81eb6b46b270514392252b0bb00768925dfa5208b6e7488
SHA512

1ac7bd0ca50ffb0e0076759c8e469e41939d31fe33dd06a6a4b8567501e3c34fed5099234297e7d584f25bf41b2b12c2e2df23170f4e577070f5096e9a6307c4
SSDEEP

1536:oTMtMuoX1HA/kHPHZKzx8lb/vrZUX21KuREP:oTyolgsvHgzylb/vrZUXPuRW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
820	2076	WerFault.exe	19

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 820	2076	NEAS.554c6ec51c7c1ed963215a1ebc33a2a0.exe	29
PID 2076 wrote to memory of 820	2076	NEAS.554c6ec51c7c1ed963215a1ebc33a2a0.exe	29
PID 2076 wrote to memory of 820	2076	NEAS.554c6ec51c7c1ed963215a1ebc33a2a0.exe	29
PID 2076 wrote to memory of 820	2076	NEAS.554c6ec51c7c1ed963215a1ebc33a2a0.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.554c6ec51c7c1ed963215a1ebc33a2a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.554c6ec51c7c1ed963215a1ebc33a2a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 48
  2⤵
  - Program crash
  PID:820

memory/2076-0-0x00000000008C0000-0x0000000000912000-memory.dmp

Filesize
328KB

Download
memory/2076-1-0x00000000008C0000-0x0000000000912000-memory.dmp

Filesize
328KB

Download