e73db14f6c52868d191e01cdf3186534bc395755d6eb7be63e7b875a28aa6f71

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:28

Target

NEAS.a3b71cb30aae5edf396bd9993b54c260.exe
Size

272KB
MD5

a3b71cb30aae5edf396bd9993b54c260
SHA1

8cbc94268c663cee5e89c3a1e85c30022550459b
SHA256

e73db14f6c52868d191e01cdf3186534bc395755d6eb7be63e7b875a28aa6f71
SHA512

74b9c0c585571fa83d79de207df31be96e9cb809fcafd2d92401fc9c3c79ddf5b0ec10cd8899e5f095b18ffd9cd6d93d4218b16288901ab20ca692852c9cf52e
SSDEEP

3072:m8RinudiP52xx67lLdhaiHJJCLCqwzBu1DjHLMVDqqkSp:rkgiPA6RKmJ2wtu1DjrFqh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	3060	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2944	3060	NEAS.a3b71cb30aae5edf396bd9993b54c260.exe	28
PID 3060 wrote to memory of 2944	3060	NEAS.a3b71cb30aae5edf396bd9993b54c260.exe	28
PID 3060 wrote to memory of 2944	3060	NEAS.a3b71cb30aae5edf396bd9993b54c260.exe	28
PID 3060 wrote to memory of 2944	3060	NEAS.a3b71cb30aae5edf396bd9993b54c260.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.a3b71cb30aae5edf396bd9993b54c260.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.a3b71cb30aae5edf396bd9993b54c260.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 36
  2⤵
  - Program crash
  PID:2944

memory/3060-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download