b0e1e4c8cb19c2f9208cff8101b83b81698a71fe456f9530e0b5b7ea1ba142b2

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:18

Target

NEAS.3e546eedc0133a68966979d243078530.exe
Size

208KB
MD5

3e546eedc0133a68966979d243078530
SHA1

9ec55563de6686aced47c6604f910d903c91dc0e
SHA256

b0e1e4c8cb19c2f9208cff8101b83b81698a71fe456f9530e0b5b7ea1ba142b2
SHA512

1a3e45d3ac96c49093136806f65d280f4aed8683b485a051cacdae3de83543385997fdf46adbfb85c48b101a0e1d23c87db58205183aabd671ee115eabb2af61
SSDEEP

768:C6cPsAifwZJ0cZGUk6vJOBdhqm2PeaiBWJQekglkU02p/1H5wXdnhf7pXdnh:1ccYH/Gnc+hmlJQekaj02LsNL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	1312	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2380	1312	NEAS.3e546eedc0133a68966979d243078530.exe	28
PID 1312 wrote to memory of 2380	1312	NEAS.3e546eedc0133a68966979d243078530.exe	28
PID 1312 wrote to memory of 2380	1312	NEAS.3e546eedc0133a68966979d243078530.exe	28
PID 1312 wrote to memory of 2380	1312	NEAS.3e546eedc0133a68966979d243078530.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.3e546eedc0133a68966979d243078530.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3e546eedc0133a68966979d243078530.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 36
  2⤵
  - Program crash
  PID:2380

memory/1312-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download