1ada43ecd9c20bba64266c34563a5726c005b373eda6ab51da2394818c679381

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 20:02

Target

NEAS.21e31e0f4cfded4b940fadd01748cb60.exe
Size

76KB
MD5

21e31e0f4cfded4b940fadd01748cb60
SHA1

05a8da119db62e2616e0a11054969fc63656731e
SHA256

1ada43ecd9c20bba64266c34563a5726c005b373eda6ab51da2394818c679381
SHA512

b9b1c42744b507a13e3158d46eb91e0f27f5edfaa74347cb3c7b1e1ea934e173cffce8fa67a464d9e4f5275091c0bef5f5bd562cbaa7e401de4b76e4b41f7402
SSDEEP

1536:7O3KbAXH/AdouO53qvTo1ORz9zlvmzTarfuesU/edhZKz/U85:7QKbvU059zA62e5ekT5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	2188	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2960	2188	NEAS.21e31e0f4cfded4b940fadd01748cb60.exe	28
PID 2188 wrote to memory of 2960	2188	NEAS.21e31e0f4cfded4b940fadd01748cb60.exe	28
PID 2188 wrote to memory of 2960	2188	NEAS.21e31e0f4cfded4b940fadd01748cb60.exe	28
PID 2188 wrote to memory of 2960	2188	NEAS.21e31e0f4cfded4b940fadd01748cb60.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.21e31e0f4cfded4b940fadd01748cb60.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.21e31e0f4cfded4b940fadd01748cb60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 36
  2⤵
  - Program crash
  PID:2960

memory/2188-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2188-1-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download