d59246f6501677595db4093f4c7353d6eb4ce246692cf05e707606c40e63abe4

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:31

Target

NEAS.c82d3e0cb5c38f354212e9aa0ce898f0.exe
Size

348KB
MD5

c82d3e0cb5c38f354212e9aa0ce898f0
SHA1

5265898effd8af3b088bdfed68b3ed1daee51c18
SHA256

d59246f6501677595db4093f4c7353d6eb4ce246692cf05e707606c40e63abe4
SHA512

75a3b49b9418de85fd2c3abe396e085151f5643a560ae78dc048e300f1262d43f11ba3c0edf42fda769543fa20847eea92c2e9e1e30266439731e8381eee741f
SSDEEP

3072:pvVteka8+OtAcKlSRz5QptoWQxF8AjJkvZniI274Ym17Iy9vu8np2:BVTarW9Q2dRHjWhS4fz9Np

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	2508	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2652	2508	NEAS.c82d3e0cb5c38f354212e9aa0ce898f0.exe	28
PID 2508 wrote to memory of 2652	2508	NEAS.c82d3e0cb5c38f354212e9aa0ce898f0.exe	28
PID 2508 wrote to memory of 2652	2508	NEAS.c82d3e0cb5c38f354212e9aa0ce898f0.exe	28
PID 2508 wrote to memory of 2652	2508	NEAS.c82d3e0cb5c38f354212e9aa0ce898f0.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.c82d3e0cb5c38f354212e9aa0ce898f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c82d3e0cb5c38f354212e9aa0ce898f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 36
  2⤵
  - Program crash
  PID:2652

memory/2508-0-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download