bd7887d74694913f917020196770c6b0f08ec03ed976919a58e85de304ab5a0b

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:22

Target

NEAS.6277de8181c9c9aae3422030c4031d10.exe
Size

272KB
MD5

6277de8181c9c9aae3422030c4031d10
SHA1

d3a4de8a6c2b36ea5d278d5c58c3727f65f0a923
SHA256

bd7887d74694913f917020196770c6b0f08ec03ed976919a58e85de304ab5a0b
SHA512

c89564dc85a6730704fe655df18304d703743235ac65caf6e73796760be49c7963b5d54442935b0a3f1209989a20130383333208c5398fc6faf246b3bd8fc719
SSDEEP

3072:i8RinudiP52xx67lLdhCiHWq8fo3PXl9Z7S/yCsKh2EzZA/:vkgiPA6RSpqgo35e/yCthvU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	2312	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2080	2312	NEAS.6277de8181c9c9aae3422030c4031d10.exe	28
PID 2312 wrote to memory of 2080	2312	NEAS.6277de8181c9c9aae3422030c4031d10.exe	28
PID 2312 wrote to memory of 2080	2312	NEAS.6277de8181c9c9aae3422030c4031d10.exe	28
PID 2312 wrote to memory of 2080	2312	NEAS.6277de8181c9c9aae3422030c4031d10.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.6277de8181c9c9aae3422030c4031d10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6277de8181c9c9aae3422030c4031d10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 36
  2⤵
  - Program crash
  PID:2080

memory/2312-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download