8868177e3f0ea0647f7f77b6eb1e9e9bceee177dae6e43e6d18d86ed9f18a0d4

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 20:03

Target

NEAS.295a71f34088e0c4b89e3bd6f255b5b0.exe
Size

196KB
MD5

295a71f34088e0c4b89e3bd6f255b5b0
SHA1

72d7cf721f9d0726867a4452039d8d15bb317921
SHA256

8868177e3f0ea0647f7f77b6eb1e9e9bceee177dae6e43e6d18d86ed9f18a0d4
SHA512

25fb19f293167db98d8690742dca991e18420df6b5e78b3c12171cbcd5c96123e916eeee7d29679797d7bb30ad6a9cbd05e6fc9f4fa707222bb294bd3cc9a47c
SSDEEP

1536:G43i6EJ02LyV3kFdp+0zI1ZBjhRDmmHeIcinLJcoHQHltrK3i6EJ02LyV3rE:cLyV3kF21im+YL0rpLyV3I

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	2992	WerFault.exe	16

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2992	NEAS.295a71f34088e0c4b89e3bd6f255b5b0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3052	2992	NEAS.295a71f34088e0c4b89e3bd6f255b5b0.exe	28
PID 2992 wrote to memory of 3052	2992	NEAS.295a71f34088e0c4b89e3bd6f255b5b0.exe	28
PID 2992 wrote to memory of 3052	2992	NEAS.295a71f34088e0c4b89e3bd6f255b5b0.exe	28
PID 2992 wrote to memory of 3052	2992	NEAS.295a71f34088e0c4b89e3bd6f255b5b0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.295a71f34088e0c4b89e3bd6f255b5b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.295a71f34088e0c4b89e3bd6f255b5b0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 188
  2⤵
  - Program crash
  PID:3052

memory/2992-0-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2992-2-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download