78621f7ac387e29bde1c6fd1237f2ae17c51b23d373335a7f06407fa84f933d5

Analysis

max time kernel
131s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 19:10

Target

NEAS.bc0a21bbef237997ec525845f7d50020.exe
Size

268KB
MD5

bc0a21bbef237997ec525845f7d50020
SHA1

9a21d5e73896490c7fae43ff2b1e86d76bc846ae
SHA256

78621f7ac387e29bde1c6fd1237f2ae17c51b23d373335a7f06407fa84f933d5
SHA512

39bfc709deb1bc8d691786b568df7c4d9d25d2bfe9db972363457a53fbe6e006ebe052d6698152937b488c0945d1704b45804a6d9c490849b287dd64b3a108f9
SSDEEP

3072:gC6xRyfFP0o35cc+rpOOxzFw0v0wnJcefSXQHPTTAkvB5Dd:gC6xRydsS+w+3tnJfKXqPTX7D

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
340	1596	WerFault.exe	83
452	1596	WerFault.exe	83
828	1596	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 340	1596	NEAS.bc0a21bbef237997ec525845f7d50020.exe	89
PID 1596 wrote to memory of 340	1596	NEAS.bc0a21bbef237997ec525845f7d50020.exe	89
PID 1596 wrote to memory of 340	1596	NEAS.bc0a21bbef237997ec525845f7d50020.exe	89

C:\Users\Admin\AppData\Local\Temp\NEAS.bc0a21bbef237997ec525845f7d50020.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.bc0a21bbef237997ec525845f7d50020.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 224
  2⤵
  - Program crash
  PID:340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 224
  2⤵
  - Program crash
  PID:452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 220
  2⤵
  - Program crash
  PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1596 -ip 1596
1⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1596 -ip 1596
1⤵
PID:4688

memory/1596-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download