5a1a8bcca2d7504ea3a63ac515024825271a276b97440ebcc2045eeaa91a9535

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:28

Target

NEAS.aa7a15cae396dc1de770453e15aa64c0.exe
Size

472KB
MD5

aa7a15cae396dc1de770453e15aa64c0
SHA1

59f6ad402daa174dc0e04d5b842854fcbd924bca
SHA256

5a1a8bcca2d7504ea3a63ac515024825271a276b97440ebcc2045eeaa91a9535
SHA512

e2f4e3310bf5ee76cb2413aed16a52f0a25b035971126fda891c4d9638e5ec4c08f453ea0b178bbf0c767e899cd2cc9b5e4d3f5319aa0262517f5ad5e7b0b3b4
SSDEEP

3072:zSO8RinudiP52xx67lLdZiHDo7SMSCKIknNNynDrSUCmnfCm04AetXS+:2DkgiPA6RbPuRbIiszf04JXS+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	1212	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 2200	1212	NEAS.aa7a15cae396dc1de770453e15aa64c0.exe	28
PID 1212 wrote to memory of 2200	1212	NEAS.aa7a15cae396dc1de770453e15aa64c0.exe	28
PID 1212 wrote to memory of 2200	1212	NEAS.aa7a15cae396dc1de770453e15aa64c0.exe	28
PID 1212 wrote to memory of 2200	1212	NEAS.aa7a15cae396dc1de770453e15aa64c0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.aa7a15cae396dc1de770453e15aa64c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.aa7a15cae396dc1de770453e15aa64c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 36
  2⤵
  - Program crash
  PID:2200

memory/1212-1-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download