5f1569212cf6800dcf33e36e5e6ba8042fb4a9ca952b5c365bebf3ad4948c38d

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:38

Target

NEAS.cbb8fcfbfefb15d47b3e5b4f6848d690.exe
Size

260KB
MD5

cbb8fcfbfefb15d47b3e5b4f6848d690
SHA1

a89f997648c12147ad013652761ddcf7551b5928
SHA256

5f1569212cf6800dcf33e36e5e6ba8042fb4a9ca952b5c365bebf3ad4948c38d
SHA512

00a5e67bdb2b373ac65148965ca951b769f85db195433cd3c24efa61722a1623d7d3a6398153579ac4bf1c415b6b9e89ff4cb659b1008e6ca3494ce20bfc6dc7
SSDEEP

768:gDApAJmxwUh6zO5g7Wfb8BvTRbdUE6Sijv7xCID5Rjto/1H5vUXdnhg8+nzNdElr:SsASwKScoNSLDh1htiVuN+zL20gJi1i

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1808	2092	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1808	2092	NEAS.cbb8fcfbfefb15d47b3e5b4f6848d690.exe	28
PID 2092 wrote to memory of 1808	2092	NEAS.cbb8fcfbfefb15d47b3e5b4f6848d690.exe	28
PID 2092 wrote to memory of 1808	2092	NEAS.cbb8fcfbfefb15d47b3e5b4f6848d690.exe	28
PID 2092 wrote to memory of 1808	2092	NEAS.cbb8fcfbfefb15d47b3e5b4f6848d690.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.cbb8fcfbfefb15d47b3e5b4f6848d690.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cbb8fcfbfefb15d47b3e5b4f6848d690.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 36
  2⤵
  - Program crash
  PID:1808

memory/2092-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download