0ea380988e6c472f3c175b65ef6364343fa9b7e69ac0cbf67d532b6e0990edbb

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 20:30

Target

NEAS.877bc86ba4b0cf09f26bb6ae3b7f4580.exe
Size

661KB
MD5

877bc86ba4b0cf09f26bb6ae3b7f4580
SHA1

6645ae86b869b3d24aa87c3c299bb38e2e6656a0
SHA256

0ea380988e6c472f3c175b65ef6364343fa9b7e69ac0cbf67d532b6e0990edbb
SHA512

f74af199e23ab395050396a80496584e536cff687ff79bc410f5c17569133e0cd7ccc3a3b015e84fb23d34872bb58005da779ef9a7275e411b805872f6b7ecb9
SSDEEP

12288:B+67XR9JSSxvododHka0FUEf8XaW/ZhCHrfrl:B+6N986dka0FUEfYaW/ZhCHrfrl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	924	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1720	924	NEAS.877bc86ba4b0cf09f26bb6ae3b7f4580.exe	28
PID 924 wrote to memory of 1720	924	NEAS.877bc86ba4b0cf09f26bb6ae3b7f4580.exe	28
PID 924 wrote to memory of 1720	924	NEAS.877bc86ba4b0cf09f26bb6ae3b7f4580.exe	28
PID 924 wrote to memory of 1720	924	NEAS.877bc86ba4b0cf09f26bb6ae3b7f4580.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.877bc86ba4b0cf09f26bb6ae3b7f4580.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.877bc86ba4b0cf09f26bb6ae3b7f4580.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 36
  2⤵
  - Program crash
  PID:1720