20f387e4d5491ce8aac7a2b5c3103444784b667a9a47419b21218a352d5b52ed

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 19:12

Target

NEAS.c404260f8287e202e10ec2719ae35150.exe
Size

320KB
MD5

c404260f8287e202e10ec2719ae35150
SHA1

7a2c8d2a612fc72433d715791184af1f7377c2a9
SHA256

20f387e4d5491ce8aac7a2b5c3103444784b667a9a47419b21218a352d5b52ed
SHA512

f0a248799ae1661d93dc74fd0b4f7a896b40eca5c55d721b6b09a7d7537d207b4c91633e4205a256a70189782e6e0bc9479e6acc0e10fda28239146f64a20461
SSDEEP

6144:7l47O9gCH2RfS155ONNXBuWoJBO9OMbHLkAqF7Ief9UmM7/uT:7lwU2EB0NxDIBuOFe7/uT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	1256	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2072	1256	NEAS.c404260f8287e202e10ec2719ae35150.exe	28
PID 1256 wrote to memory of 2072	1256	NEAS.c404260f8287e202e10ec2719ae35150.exe	28
PID 1256 wrote to memory of 2072	1256	NEAS.c404260f8287e202e10ec2719ae35150.exe	28
PID 1256 wrote to memory of 2072	1256	NEAS.c404260f8287e202e10ec2719ae35150.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.c404260f8287e202e10ec2719ae35150.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c404260f8287e202e10ec2719ae35150.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 36
  2⤵
  - Program crash
  PID:2072

memory/1256-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1256-1-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download