8ef250589049528ec7ee51a7dd383231f384f603a0ff9a9c47c52142b6ad5d8a

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:36

Target

NEAS.c3b4852e51b14c0b96eb091032a3e050.exe
Size

89KB
MD5

c3b4852e51b14c0b96eb091032a3e050
SHA1

5c3fbafee89ea213f83d2678eae394955ce4665c
SHA256

8ef250589049528ec7ee51a7dd383231f384f603a0ff9a9c47c52142b6ad5d8a
SHA512

37e2385a328c69522d026520cbb52cbc84c400238f7f0d216ff3ffad90ebea6d25b1becd2303ddc56847436e7def2bd17da0e8c5b2d8b1be9bc4e61a6265ba18
SSDEEP

768:9/gV8e3sbM+aCZlV1yMbX7Bv9us0oXxaSKGkjTMf/SzkDb2Tp+sa00vY5AJqTDXH:RgKFrL1yCh9us0oBtFkMF6rnXpDeiD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2068	2088	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2068	2088	NEAS.c3b4852e51b14c0b96eb091032a3e050.exe	28
PID 2088 wrote to memory of 2068	2088	NEAS.c3b4852e51b14c0b96eb091032a3e050.exe	28
PID 2088 wrote to memory of 2068	2088	NEAS.c3b4852e51b14c0b96eb091032a3e050.exe	28
PID 2088 wrote to memory of 2068	2088	NEAS.c3b4852e51b14c0b96eb091032a3e050.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.c3b4852e51b14c0b96eb091032a3e050.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c3b4852e51b14c0b96eb091032a3e050.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 532
  2⤵
  - Program crash
  PID:2068

memory/2088-0-0x0000000074300000-0x00000000749EE000-memory.dmp

Filesize
6.9MB

Download
memory/2088-1-0x00000000000F0000-0x000000000010A000-memory.dmp

Filesize
104KB

Download
memory/2088-2-0x0000000074300000-0x00000000749EE000-memory.dmp

Filesize
6.9MB

Download