f48e60adf4b7bb87bae7ca0aa0737ac94740e66108d966a6028f300fb9c87dc2

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16-10-2023 18:26

Target

NEAS.81f809a70244206c850367e9d1e7c120.exe
Size

292KB
MD5

81f809a70244206c850367e9d1e7c120
SHA1

9e146f34cf819ddffe990842fbfce292510e1750
SHA256

f48e60adf4b7bb87bae7ca0aa0737ac94740e66108d966a6028f300fb9c87dc2
SHA512

cdb966e2bf536417e7994f4864466bbb8161240771ae653a34c846fcd1f0b9ca39d8f1d968d3964e6958e6fc9c9be3b42020856be9b179d5770b94c1f352dc1f
SSDEEP

3072:sEkaQVF4iosF3G9ARP89OmzE5n4FBloOYMZjJDXrpCNOtnGMoNaUtnZ6I3bs/BSD:2/oGRP89OH9KuOYWYtZxLcSsQLH5Adm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1656	2472	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 1656	2472	NEAS.81f809a70244206c850367e9d1e7c120.exe	28
PID 2472 wrote to memory of 1656	2472	NEAS.81f809a70244206c850367e9d1e7c120.exe	28
PID 2472 wrote to memory of 1656	2472	NEAS.81f809a70244206c850367e9d1e7c120.exe	28
PID 2472 wrote to memory of 1656	2472	NEAS.81f809a70244206c850367e9d1e7c120.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.81f809a70244206c850367e9d1e7c120.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.81f809a70244206c850367e9d1e7c120.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 200
  2⤵
  - Program crash
  PID:1656

memory/2472-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2472-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download