e6b1ea82c2aa4dbdcf80bade33a7c954dc5153c57af1268488a870bdab5dcc79

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:26

Target

NEAS.80665d9499ca0ea70c32b996a0d6e060.exe
Size

260KB
MD5

80665d9499ca0ea70c32b996a0d6e060
SHA1

2b0f6363824fa851c20bffcf565e9ce2d514c315
SHA256

e6b1ea82c2aa4dbdcf80bade33a7c954dc5153c57af1268488a870bdab5dcc79
SHA512

a7c1342d9381f9635ed3a6cf00b9618b1063d87e142d77d46389a37ccc8ea0de29eaaa4b40aabce5f4c4d4aa0a3000ebf2acf4f242a966cc30cd33a12c92ea48
SSDEEP

3072:48RinudiP52xx67lLdhiiHSiS1WdTCn93OGey/Zh:NkgiPA6RSLihTCndOGeK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	2080	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2920	2080	NEAS.80665d9499ca0ea70c32b996a0d6e060.exe	28
PID 2080 wrote to memory of 2920	2080	NEAS.80665d9499ca0ea70c32b996a0d6e060.exe	28
PID 2080 wrote to memory of 2920	2080	NEAS.80665d9499ca0ea70c32b996a0d6e060.exe	28
PID 2080 wrote to memory of 2920	2080	NEAS.80665d9499ca0ea70c32b996a0d6e060.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.80665d9499ca0ea70c32b996a0d6e060.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.80665d9499ca0ea70c32b996a0d6e060.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 36
  2⤵
  - Program crash
  PID:2920

memory/2080-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download