8958fb2ad9db3f48dd8fc54a2b1fc3e9f3d0d17e02272cbef91a5ff7b12d7416

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:16

Target

NEAS.2f7e26f6e79d01ff5160ec1aea06f700.exe
Size

56KB
MD5

2f7e26f6e79d01ff5160ec1aea06f700
SHA1

4b4df65d6a59aa94e4d90f870f8962592cdc7eca
SHA256

8958fb2ad9db3f48dd8fc54a2b1fc3e9f3d0d17e02272cbef91a5ff7b12d7416
SHA512

ed361d3eb36249fd240c13a1d3f7b11c6d02080d0b6f48356d4cc6702bd5c3d51e44941a65d4fb91bdb07de8560ade0ae9deba70cb7b56c1aa49e16c2029c331
SSDEEP

768:80SzA0KuC/VrSwYRiEqb+cDIDpVbfhsGe3X333333333333333o33u5RH:80IA0OVWwgiJ+cUVY3P5RH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	2836	WerFault.exe	27

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2208	2836	NEAS.2f7e26f6e79d01ff5160ec1aea06f700.exe	28
PID 2836 wrote to memory of 2208	2836	NEAS.2f7e26f6e79d01ff5160ec1aea06f700.exe	28
PID 2836 wrote to memory of 2208	2836	NEAS.2f7e26f6e79d01ff5160ec1aea06f700.exe	28
PID 2836 wrote to memory of 2208	2836	NEAS.2f7e26f6e79d01ff5160ec1aea06f700.exe	28
PID 2836 wrote to memory of 2208	2836	NEAS.2f7e26f6e79d01ff5160ec1aea06f700.exe	28
PID 2836 wrote to memory of 2208	2836	NEAS.2f7e26f6e79d01ff5160ec1aea06f700.exe	28
PID 2836 wrote to memory of 2208	2836	NEAS.2f7e26f6e79d01ff5160ec1aea06f700.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2f7e26f6e79d01ff5160ec1aea06f700.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2f7e26f6e79d01ff5160ec1aea06f700.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 196
  2⤵
  - Program crash
  PID:2208