be59515f36a9504b9348e3eb434a2e3565692705444d615f34f819ba27470c61

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 17:59

Target

NEAS.75cd1244fd78e304fe4a230239b6ef30.exe
Size

170KB
MD5

75cd1244fd78e304fe4a230239b6ef30
SHA1

0a7984e1cdcca37efbc1877a5c609a6c2945ea7a
SHA256

be59515f36a9504b9348e3eb434a2e3565692705444d615f34f819ba27470c61
SHA512

2ad42c48eb91262d988a7f68e0067a085c4e84b3f7a0e66d2132bd24a00bc10932a1a6b03190b5f8666da413453674734be8f3f3dab5b4595128545561e6e3cc
SSDEEP

3072:wVSYYZbASP/+OGDJIZBcyJ+RXQK4UbwWhbZuq3sPE:w4DbAS6DJIZBaR4bWhbgE

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4920	2664	WerFault.exe	87
4228	2664	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 4920	2664	NEAS.75cd1244fd78e304fe4a230239b6ef30.exe	90
PID 2664 wrote to memory of 4920	2664	NEAS.75cd1244fd78e304fe4a230239b6ef30.exe	90
PID 2664 wrote to memory of 4920	2664	NEAS.75cd1244fd78e304fe4a230239b6ef30.exe	90

C:\Users\Admin\AppData\Local\Temp\NEAS.75cd1244fd78e304fe4a230239b6ef30.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.75cd1244fd78e304fe4a230239b6ef30.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 400
  2⤵
  - Program crash
  PID:4920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 400
  2⤵
  - Program crash
  PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2664 -ip 2664
1⤵
PID:3344