deb4d6c5b2e59574007511bb586de4cf49a0d2051375d3679b3dd668de58a33a

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16-10-2023 18:24

Target

NEAS.72d9cf69c630fe59c084ca1de634b6c0.exe
Size

2.8MB
MD5

72d9cf69c630fe59c084ca1de634b6c0
SHA1

3ef657490330a73d47c8c2d42fe7e0dd8c4ce4f9
SHA256

deb4d6c5b2e59574007511bb586de4cf49a0d2051375d3679b3dd668de58a33a
SHA512

791a923f2fb719070991c7eb7cb52d02eaf8f40502e4a002511d7572401f901bb2e52f95b67e606d37a8cefa51119150f820e7849d760d8be41499545df795d4
SSDEEP

49152:hh1hnqCCS0MJhH3pCqw/6w/w+s8KuqGaX0ToIBAUZLY/:fTqCT0MJ+qw/6w/TJBAUZLA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2620	2236	WerFault.exe	27

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2236	NEAS.72d9cf69c630fe59c084ca1de634b6c0.exe
2236	NEAS.72d9cf69c630fe59c084ca1de634b6c0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2620	2236	NEAS.72d9cf69c630fe59c084ca1de634b6c0.exe	30
PID 2236 wrote to memory of 2620	2236	NEAS.72d9cf69c630fe59c084ca1de634b6c0.exe	30
PID 2236 wrote to memory of 2620	2236	NEAS.72d9cf69c630fe59c084ca1de634b6c0.exe	30
PID 2236 wrote to memory of 2620	2236	NEAS.72d9cf69c630fe59c084ca1de634b6c0.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.72d9cf69c630fe59c084ca1de634b6c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.72d9cf69c630fe59c084ca1de634b6c0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 292
  2⤵
  - Program crash
  PID:2620