ff1015826562028556b0ace0f53a0ca975c7701ac1ed309ca7c96a86c01de6ca

Analysis

max time kernel
167s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:43

Target

NEAS.d5702262d835ae79234434d4ebabbfa0.exe
Size

608KB
MD5

d5702262d835ae79234434d4ebabbfa0
SHA1

58105538aff92c0de917714c453d64211ed4e3b8
SHA256

ff1015826562028556b0ace0f53a0ca975c7701ac1ed309ca7c96a86c01de6ca
SHA512

41708c3bad04e159d31cd7ea99dbe60e6d4dea1993f5f4b5805f99aee5b6c15d8c2d0ebec0435da1a468b0aa78cef775b83ebfeb4e391949024b0a6bc3955143
SSDEEP

3072:wCaoAs101Pol0xPTM7mRCAdJSSxPUkl3V8MQTCk/dN92sdNhavtrVdewnAx3wmVv:wqDAwl0xPTMiR9JSSxPUK4dodHi

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4768	2424	WerFault.exe	85
568	2424	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 4768	2424	NEAS.d5702262d835ae79234434d4ebabbfa0.exe	91
PID 2424 wrote to memory of 4768	2424	NEAS.d5702262d835ae79234434d4ebabbfa0.exe	91
PID 2424 wrote to memory of 4768	2424	NEAS.d5702262d835ae79234434d4ebabbfa0.exe	91

C:\Users\Admin\AppData\Local\Temp\NEAS.d5702262d835ae79234434d4ebabbfa0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d5702262d835ae79234434d4ebabbfa0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 224
  2⤵
  - Program crash
  PID:4768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 224
  2⤵
  - Program crash
  PID:568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2424 -ip 2424
1⤵
PID:1664