2685d0351b7b560ee9e3cf475a024ea430c2cc94e906c5b70398576d4a5648cc

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 19:13

Target

NEAS.c8eb6efe65ed8a5caf574f56946d1bc0.exe
Size

47KB
MD5

c8eb6efe65ed8a5caf574f56946d1bc0
SHA1

6d2ebeedd123c822655b4bda0dd1db63a55473f6
SHA256

2685d0351b7b560ee9e3cf475a024ea430c2cc94e906c5b70398576d4a5648cc
SHA512

70ef6b31170870cec46fe16c612fd1e605ee4eca95eea06289d9ba7c2b8bcdf57b3202ff9b4f41e1589946195c753524fa3a2b862d5b3b4e1a07575634117c23
SSDEEP

768:0ORCDtny0aIQ1GN//nziIidpdmNyHOsk0T7rT/a93Pty2DcV+ohAdCMuFO:TCny0K1szOdpdmNyusVjm93ly2DcVGEF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	280	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
280	NEAS.c8eb6efe65ed8a5caf574f56946d1bc0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 280 wrote to memory of 2160	280	NEAS.c8eb6efe65ed8a5caf574f56946d1bc0.exe	29
PID 280 wrote to memory of 2160	280	NEAS.c8eb6efe65ed8a5caf574f56946d1bc0.exe	29
PID 280 wrote to memory of 2160	280	NEAS.c8eb6efe65ed8a5caf574f56946d1bc0.exe	29
PID 280 wrote to memory of 2160	280	NEAS.c8eb6efe65ed8a5caf574f56946d1bc0.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.c8eb6efe65ed8a5caf574f56946d1bc0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c8eb6efe65ed8a5caf574f56946d1bc0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 280 -s 124
  2⤵
  - Program crash
  PID:2160

memory/280-0-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download
memory/280-1-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/280-2-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download