0a4f82bc1cf17defb2f95b6ca27fd2fb8f48a05a0610d2a407c58bb801d51818

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 11:25

Target

NEAS.0a5e655cfca81cf3de65d34f6c371b90_JC.exe
Size

84KB
MD5

0a5e655cfca81cf3de65d34f6c371b90
SHA1

647d8bbfc3e807f4da1c2f9827a9f90546cc020e
SHA256

0a4f82bc1cf17defb2f95b6ca27fd2fb8f48a05a0610d2a407c58bb801d51818
SHA512

1823813247ab3951d3ca6673373236f51ab524ba376cb25d37af59971a7c6aa08eed622fbfae298d70318df9242025de3594223070c15b3f1f016325d545c5c1
SSDEEP

1536:I9ekVbaQP2THnlWvl82KuJ8BUZghMZGcXwzaN3vL91k1YmfbhF:I9eBFWtn/+gRzN3THkmsbhF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2332	1824	NEAS.0a5e655cfca81cf3de65d34f6c371b90_JC.exe	28
PID 1824 wrote to memory of 2332	1824	NEAS.0a5e655cfca81cf3de65d34f6c371b90_JC.exe	28
PID 1824 wrote to memory of 2332	1824	NEAS.0a5e655cfca81cf3de65d34f6c371b90_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.0a5e655cfca81cf3de65d34f6c371b90_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0a5e655cfca81cf3de65d34f6c371b90_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1824 -s 504
  2⤵
  PID:2332

memory/1824-0-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/1824-1-0x0000000000C70000-0x0000000000C8C000-memory.dmp

Filesize
112KB

Download
memory/1824-2-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download