ff1015826562028556b0ace0f53a0ca975c7701ac1ed309ca7c96a86c01de6ca

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 20:43

Target

NEAS.d5702262d835ae79234434d4ebabbfa0.exe
Size

608KB
MD5

d5702262d835ae79234434d4ebabbfa0
SHA1

58105538aff92c0de917714c453d64211ed4e3b8
SHA256

ff1015826562028556b0ace0f53a0ca975c7701ac1ed309ca7c96a86c01de6ca
SHA512

41708c3bad04e159d31cd7ea99dbe60e6d4dea1993f5f4b5805f99aee5b6c15d8c2d0ebec0435da1a468b0aa78cef775b83ebfeb4e391949024b0a6bc3955143
SSDEEP

3072:wCaoAs101Pol0xPTM7mRCAdJSSxPUkl3V8MQTCk/dN92sdNhavtrVdewnAx3wmVv:wqDAwl0xPTMiR9JSSxPUK4dodHi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	1872	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 3012	1872	NEAS.d5702262d835ae79234434d4ebabbfa0.exe	27
PID 1872 wrote to memory of 3012	1872	NEAS.d5702262d835ae79234434d4ebabbfa0.exe	27
PID 1872 wrote to memory of 3012	1872	NEAS.d5702262d835ae79234434d4ebabbfa0.exe	27
PID 1872 wrote to memory of 3012	1872	NEAS.d5702262d835ae79234434d4ebabbfa0.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.d5702262d835ae79234434d4ebabbfa0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d5702262d835ae79234434d4ebabbfa0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 36
  2⤵
  - Program crash
  PID:3012