210e0bf8c9edef4541d1cb93f0bf3e22b9cbc9ac8646a8dcdb373f367b91a86c

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 19:46

Target

NEAS.1aca635eefd73f8d64e4a10e1e5e1ce0.exe
Size

83KB
MD5

1aca635eefd73f8d64e4a10e1e5e1ce0
SHA1

dc79b314122453d37bbf81e792a258d0a32a1260
SHA256

210e0bf8c9edef4541d1cb93f0bf3e22b9cbc9ac8646a8dcdb373f367b91a86c
SHA512

ad288230539e983343ed8d6f81a61c8e360c297ce883b0aed1d8b70a68f380ccf6e5f6c610dde704c7251ae345ea64dd76335e7ede8ca643d3a41da16f99280d
SSDEEP

1536:5FFF0o8lJqeucCbMsbeiVb29hoNi/Tg7dcvblHln6cGoPLfnTLAqw0+Cq2zwSqBN:0Cb+kZpH5ZgZ7UTSHs2q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2436	744	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 2436	744	NEAS.1aca635eefd73f8d64e4a10e1e5e1ce0.exe	21
PID 744 wrote to memory of 2436	744	NEAS.1aca635eefd73f8d64e4a10e1e5e1ce0.exe	21
PID 744 wrote to memory of 2436	744	NEAS.1aca635eefd73f8d64e4a10e1e5e1ce0.exe	21
PID 744 wrote to memory of 2436	744	NEAS.1aca635eefd73f8d64e4a10e1e5e1ce0.exe	21

C:\Users\Admin\AppData\Local\Temp\NEAS.1aca635eefd73f8d64e4a10e1e5e1ce0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1aca635eefd73f8d64e4a10e1e5e1ce0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 36
  2⤵
  - Program crash
  PID:2436

memory/744-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/744-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download