1b254229d05a91d4aac54b74b171b955bf36cf0b10effb2438fde38722d11005

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:34

Target

NEAS.b6d736b79f93651af52b0bc0925da4b0.exe
Size

272KB
MD5

b6d736b79f93651af52b0bc0925da4b0
SHA1

d67b62cdaf255e12c2ef18faaeaddf95b4c3388f
SHA256

1b254229d05a91d4aac54b74b171b955bf36cf0b10effb2438fde38722d11005
SHA512

fd581bb3705633f6eb9bbafd2fd031afb9e46f6e04ef58bee58abe562828158e3ad4f97400d2c206bfdb3b99d23bb6d7b9774f98cfe4c16ffbe6bceb0e1981fc
SSDEEP

1536:csASwKScoNSLDhJfQ7VAPgnDNBrcN4i6tBYuR3PlNPMA:cBSwx8Hh5Q7VAPgxed6BYudlNPMA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	1444	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2240	1444	NEAS.b6d736b79f93651af52b0bc0925da4b0.exe	28
PID 1444 wrote to memory of 2240	1444	NEAS.b6d736b79f93651af52b0bc0925da4b0.exe	28
PID 1444 wrote to memory of 2240	1444	NEAS.b6d736b79f93651af52b0bc0925da4b0.exe	28
PID 1444 wrote to memory of 2240	1444	NEAS.b6d736b79f93651af52b0bc0925da4b0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.b6d736b79f93651af52b0bc0925da4b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b6d736b79f93651af52b0bc0925da4b0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 36
  2⤵
  - Program crash
  PID:2240

memory/1444-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download