151b9cc8e7b64594528c3ad2dfab4d39a1f946e41fd8c2571adb6ade0b92ff63

Analysis

max time kernel
119s
max time network
152s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 17:58

Target

NEAS.6ec29c3f0ff8672f330481cf66873840.exe
Size

329KB
MD5

6ec29c3f0ff8672f330481cf66873840
SHA1

5a124934f74303fcce7ddf7e8be5e2f690e2ba9d
SHA256

151b9cc8e7b64594528c3ad2dfab4d39a1f946e41fd8c2571adb6ade0b92ff63
SHA512

523c2a3b56d54e880056f2914ce7efeda0a96cc42c9340ef8e8ab8c0870154d3908bc91ee8a31ffcc942f9c09bb00664e1812d1586c78eb2e015504aa7e7772c
SSDEEP

96:8q9trollDYqYWCehbhPDwiqkmci0K6M3176HVe6U9v/DJ4I:D9tMll7YWBNkZ1Xl/t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	2416	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3068	2416	NEAS.6ec29c3f0ff8672f330481cf66873840.exe	28
PID 2416 wrote to memory of 3068	2416	NEAS.6ec29c3f0ff8672f330481cf66873840.exe	28
PID 2416 wrote to memory of 3068	2416	NEAS.6ec29c3f0ff8672f330481cf66873840.exe	28
PID 2416 wrote to memory of 3068	2416	NEAS.6ec29c3f0ff8672f330481cf66873840.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.6ec29c3f0ff8672f330481cf66873840.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6ec29c3f0ff8672f330481cf66873840.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 36
  2⤵
  - Program crash
  PID:3068

memory/2416-0-0x0000000000400000-0x000000000045935C-memory.dmp

Filesize
356KB

Download