1ad8863fec07e2f7bf2734b9279714e2b4fb51bb78e3f7628b68556df8094928

Analysis

max time kernel
181s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 08:20

Target

NEAS.e80afbea3c7427d36802ed24bea3f8b0.exe
Size

408KB
MD5

e80afbea3c7427d36802ed24bea3f8b0
SHA1

f5a6680435fade408241fd3096c98e3a3af1b425
SHA256

1ad8863fec07e2f7bf2734b9279714e2b4fb51bb78e3f7628b68556df8094928
SHA512

5540e0f69109dfe34c3be4aa1960bfff0397cb0e63bfffd4bc550ea5c0828c9288a202f988ac2782d6988d1c07b160b5827addb9b63aaad42a52cb20fe5bf8a8
SSDEEP

12288:zGe7meZlHU0Xoyb0/U+O1dB7Ua09HVhzYf:zWeLHpXom08+YdB7U5HjYf

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
776	1384	WerFault.exe	32
3996	1384	WerFault.exe	32

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 776	1384	NEAS.e80afbea3c7427d36802ed24bea3f8b0.exe	89
PID 1384 wrote to memory of 776	1384	NEAS.e80afbea3c7427d36802ed24bea3f8b0.exe	89
PID 1384 wrote to memory of 776	1384	NEAS.e80afbea3c7427d36802ed24bea3f8b0.exe	89

C:\Users\Admin\AppData\Local\Temp\NEAS.e80afbea3c7427d36802ed24bea3f8b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e80afbea3c7427d36802ed24bea3f8b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 472
  2⤵
  - Program crash
  PID:776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 472
  2⤵
  - Program crash
  PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1384 -ip 1384
1⤵
PID:1376