36c78c76269da4f6e913cb592f9c89a0932690cab456f343b52f2d4d79c5ef98

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 20:44

Target

NEAS.d985554a02ec43090f82db8c875921b0.exe
Size

200KB
MD5

d985554a02ec43090f82db8c875921b0
SHA1

eee8237df53e9bb0db505b6d64c2ee5252f6908c
SHA256

36c78c76269da4f6e913cb592f9c89a0932690cab456f343b52f2d4d79c5ef98
SHA512

52329cf17b229cfa4b720219cd7cd4c470d61dac949105c1d9fcb7fa25fa16753db950ceb21ebbe07a13ca1f5c97ce62a1fbb411c0d65cbdf57809b68deb4fc1
SSDEEP

768:VvMeEXxR3F8UNvrJb0PztsYDpVLGc3HZWok/6pSypktyYrz6/1H5J:VkzXF8CvrJ4PBhDP35RQxz4z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	3048	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1292	3048	NEAS.d985554a02ec43090f82db8c875921b0.exe	27
PID 3048 wrote to memory of 1292	3048	NEAS.d985554a02ec43090f82db8c875921b0.exe	27
PID 3048 wrote to memory of 1292	3048	NEAS.d985554a02ec43090f82db8c875921b0.exe	27
PID 3048 wrote to memory of 1292	3048	NEAS.d985554a02ec43090f82db8c875921b0.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.d985554a02ec43090f82db8c875921b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d985554a02ec43090f82db8c875921b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 36
  2⤵
  - Program crash
  PID:1292

memory/3048-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download