d530440c1108a98bbe761e42c3d4d17393f6b000eb3e5285eb932e2279a52faa

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:31

Target

NEAS.c4f7a82b89c08fdaef2367cd1cd56ba0.exe
Size

1.0MB
MD5

c4f7a82b89c08fdaef2367cd1cd56ba0
SHA1

3620af49f8cf65e97de7994e013097bad0487671
SHA256

d530440c1108a98bbe761e42c3d4d17393f6b000eb3e5285eb932e2279a52faa
SHA512

32de4ce88992edb33c8ab0c9dd07fc17393b4be329e09ffb55c459fe45b24c33300e5acb4afbc2003426bccdef9c37c627e7714479c7128765ff1af78318d1f5
SSDEEP

24576:0pu0QwUam1imXQR5RSt8VqqUUUUUUpUuVs36Qz:0pTItTXccqUUUUUUpUx

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1092	1856	NEAS.c4f7a82b89c08fdaef2367cd1cd56ba0.exe	28
PID 1856 wrote to memory of 1092	1856	NEAS.c4f7a82b89c08fdaef2367cd1cd56ba0.exe	28
PID 1856 wrote to memory of 1092	1856	NEAS.c4f7a82b89c08fdaef2367cd1cd56ba0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.c4f7a82b89c08fdaef2367cd1cd56ba0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c4f7a82b89c08fdaef2367cd1cd56ba0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1856 -s 540
  2⤵
  PID:1092

memory/1856-0-0x0000000010080000-0x0000000010192000-memory.dmp

Filesize
1.1MB

Download
memory/1856-1-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/1856-2-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download