5b909da082d6074a35aae47b50c2e12b13e1c76e06ee27f889f31964c59397c4

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 18:04

Target

NEAS.8c94b1278e16bc6efa223680419a4470.exe
Size

64KB
MD5

8c94b1278e16bc6efa223680419a4470
SHA1

804295b1101eb9e6b326407b4da1983217018069
SHA256

5b909da082d6074a35aae47b50c2e12b13e1c76e06ee27f889f31964c59397c4
SHA512

d5977b90e866ab5ed78ba3ac0522d40e07299b3bf857610741822150bc8443a6aa4a025524b434595900c68bdea685fc920db713a8b6790f80cb959d7b9af9da
SSDEEP

1536:eYEj8BJu6B5SssscnOCdxRs2fWf5m8G0O9L2LP2+lWu:eETuds1cnDS2ef5m8G0jP2+L

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	2332	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2028	2332	NEAS.8c94b1278e16bc6efa223680419a4470.exe	28
PID 2332 wrote to memory of 2028	2332	NEAS.8c94b1278e16bc6efa223680419a4470.exe	28
PID 2332 wrote to memory of 2028	2332	NEAS.8c94b1278e16bc6efa223680419a4470.exe	28
PID 2332 wrote to memory of 2028	2332	NEAS.8c94b1278e16bc6efa223680419a4470.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.8c94b1278e16bc6efa223680419a4470.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.8c94b1278e16bc6efa223680419a4470.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 140
  2⤵
  - Program crash
  PID:2028

memory/2332-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2332-1-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download