b3770cba9d64a82acb08c8646085b470081cb8db4a2201e371cf4692dd52f3ad

Analysis

max time kernel
119s
max time network
144s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 20:31

Target

NEAS.91552d06d7bed01045e95385bfd771f0.exe
Size

73KB
MD5

91552d06d7bed01045e95385bfd771f0
SHA1

d69cd4ec89c92348bc5418be046a4fdd207c4d28
SHA256

b3770cba9d64a82acb08c8646085b470081cb8db4a2201e371cf4692dd52f3ad
SHA512

d8003ae7b1d74643f63ccaf8867dc6a5b41664a6f622dee3dce4cf15a85a8efb63c481c2379332424d3f53c467467be76d87f1a74aaf9f7a586f75ce6da76899
SSDEEP

768:mkL7pwhEeHgFWYlZJ1KHJeCfI/Hv9nYPOVQSC4B/1H5:F7pNeATl70HJeVYPktrD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2324	1668	WerFault.exe	5

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2324	1668	NEAS.91552d06d7bed01045e95385bfd771f0.exe	29
PID 1668 wrote to memory of 2324	1668	NEAS.91552d06d7bed01045e95385bfd771f0.exe	29
PID 1668 wrote to memory of 2324	1668	NEAS.91552d06d7bed01045e95385bfd771f0.exe	29
PID 1668 wrote to memory of 2324	1668	NEAS.91552d06d7bed01045e95385bfd771f0.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.91552d06d7bed01045e95385bfd771f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.91552d06d7bed01045e95385bfd771f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 140
  2⤵
  - Program crash
  PID:2324

memory/1668-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1668-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download